joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4372f5
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43f9d2
call fcn.0043b650
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x445c8c
mov dword [esi + 4], 0x445c74
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.00402b75
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], 1
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov byte [esi + 0x58], bl
mov byte [esi + 0x59], bl
mov dword [esi], 0x445c58
mov dword [esi + 4], 0x445c40
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x43b2d0
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call sub.MSVCRT.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x43b2f8
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x43b307
mov eax, 1
ret 4

Function at 0x43b310
Capabilities:
Create thread
Resume thread

Disassembly:
push esi
push edi
lea eax, [esp + 0xc]
push eax
push 4
mov edi, ecx
mov ecx, dword [esp + 0x14]
push ecx
push edx
push 0
push 0
call sub.MSVCRT.dll__beginthreadex
mov esi, eax
add esp, 0x18
mov dword [edi], esi
test esi, esi
je 0x43b356
mov edx, dword [esp + 0x10]
push edx
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x43b356
mov eax, edi
pop edi
pop esi
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x43b351
pop edi
mov eax, 1
pop esi
ret 8

Function at 0x43b5e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
lea eax, [esp]
mov dword [esp], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x43b60c
cmp dword [esp + 4], 6
jne 0x43b60c
mov eax, dword [esp + 8]
test eax, eax
je 0x43b62e
push str.SetDefaultDllDirectories
push 0x441320
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43b62e
push 0xc00
call eax
add esp, 0x114
ret
Function at 0x40152c
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [esp + 8], 0xf003f
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
call eax
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4015dc
mov dword [esp + 8], 0xf01ff
mov dword [esp + 4], str.MAPMEM
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_OpenServiceA]
call eax
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call eax
sub esp, 4
cmp dword [ebp - 0x14], 0
je 0x4015dc
lea eax, [ebp - 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_ControlService]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x4015e1
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
call fcn.0040152c
mov dword [esp + 8], 0xf003f
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
call eax
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x401679
mov dword [esp + 8], 0xf01ff
mov dword [esp + 4], str.MAPMEM
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_OpenServiceA]
call eax
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call eax
sub esp, 4
cmp dword [ebp - 0x14], 0
je 0x401679
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_DeleteService]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x40167e
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [esp + 8], 0xf003f
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
call eax
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x401743
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], str._SystemRoot__system32drivers_fxptl.sys
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0xf01ff
mov dword [esp + 8], str.MAPMEM
mov dword [esp + 4], str.MAPMEM
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CreateServiceA]
call eax
sub esp, 0x34
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call eax
sub esp, 4
cmp dword [ebp - 0xc], 0
jne 0x401750
mov eax, 0
jmp 0x401765
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call eax
sub esp, 4
mov eax, 1
leave
ret

Function at 0x401767
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov dword [esp + 8], 0xf003f
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
call eax
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40182c
mov dword [esp + 8], 0xf01ff
mov dword [esp + 4], str.MAPMEM
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_OpenServiceA]
call eax
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call eax
sub esp, 4
cmp dword [ebp - 0x14], 0
je 0x40182c
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_StartServiceA]
call eax
sub esp, 0xc
test eax, eax
jne 0x40180d
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 0x420
jne 0x401814
mov eax, 1
jmp 0x401819
mov eax, 0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x401e90
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00407f60
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00407f60
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x401ef0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40d070]
test esi, esi
jle 0x402010
mov eax, dword [0x40d074]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401f24
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401fa7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401f10
mov dword [esp], ebx
call fcn.004028e0
mov edi, eax
test eax, eax
je 0x402037
mov eax, dword [0x40d074]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402a20
mov edx, dword [0x40d074]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x402017
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401fa0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401fb0
add dword [0x40d070], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40d074]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401fa0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401e90
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x401f2e
mov eax, dword [0x40d074]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401e90
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401e90
lea esi, [esi]
nop

Function at 0x402550
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40d08c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40d084]
sub esp, 4
test ebx, ebx
je 0x4025a5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40259e
test esi, esi
je 0x40259e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402580
mov dword [esp], 0x40d08c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4028e0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402905
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402910
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402905
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402958
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40294e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40295a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402940
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4010b5
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40110e
push ebx
push edi
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 0xffffffe6
cmp eax, 0xf85
ja 0x4010ff
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
ret

Function at 0x401113
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
call ebx
cmp eax, 0x19
jl 0x40117a
push esi
push dword [ebp + 8]
call ebx
imul eax, eax, 3
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push dword [ebp + 8]
mov esi, eax
call ebx
inc eax
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
pop esi
pop ebx
pop ebp
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
pop ebp
ret

Function at 0x40198f
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push str.mecnssdqope
xor edi, edi
push 1
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4019d4
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x401914
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4019e7

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1004cb30
Capabilities:
Encode data using xor

Disassembly:
xor dword [eax + 0x47e6d015], ebx
jns sym.d3d9.dll_Direct3DCreate9
sbb ch, byte [ebx]
or eax, 0x72f8351d
invalid

Function at 0x1209945c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x12099466
pushal
call 0x1209946c
pop ebp
sub ebp, 0x10
sub ebp, 0x209945c
mov al, byte [esp + 0x28]
cmp al, 1
je 0x12099490
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x12099499
mov eax, 0x209945c
add eax, ebp
add eax, 0x63
mov ecx, 0x5b7
mov edx, 0xec97c3a2
xor byte [eax], dl
inc eax
dec ecx
jne 0x120994b0
jmp 0x120994c3
sub dword [edi + 0x29], ebp
sub ebx, dword [esi + 0x23a2a2a2]
arpl word [edx - 0x5e], bx
mov byte [0x1a6fa1a2], al
movsb byte es:[edi], byte [esi]
mov byte [0x8a18a2a2], al
mov byte [0x4055a2a2], al
mov eax, dword [0xae23296a]
mov byte [0x67a1a2a2], al
das
mov byte [esi - 0x7959d4a2], 0xf2
retf 0x9d92

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x25802400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x2580240f
pop dword [ebp - 0x18]
mov eax, 0x4313831e
sub eax, 0x1d935f0f
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x6638382c
add dword [ebp - 0x28], 0xe81a0d1f
mov dword [ebp - 0x24], 0xe8f0634b
sub dword [ebp - 0x24], 0xb6bd1706
mov dword [ebp - 0x20], 0xa76dbe5
add dword [ebp - 0x20], 0x41d56849
mov dword [ebp - 0x1c], 0xe941531d
add dword [ebp - 0x1c], 0x16beace3
lea eax, [ebp - 0x28]
push eax
mov eax, 0xf03b65e7
add eax, 0x35466a5d
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xf45ba10b
sub dword [ebp - 0x28], 0x7fe937b5
mov dword [ebp - 0x24], 0xbc4bae39
add dword [ebp - 0x24], 0x8520b33c
mov dword [ebp - 0x20], 0xdaf82d44
add dword [ebp - 0x20], 0x88773f28
mov dword [ebp - 0x1c], 0x86cc0aee
sub dword [ebp - 0x1c], 0x86cc0aee
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3ad9b
push 0
call eax
mov ecx, 0x95f154f8
sub ecx, 0x95f114eb
mov ebx, eax
mov edi, 0xb9c926a3
sub edi, 0x944690a3
add edi, dword [ebp - 0x18]
mov edx, 0xa36eefee
xor dword [ebp - 0x10], 0x247c48e5
mov esi, dword [edi]
sub dword [ebp - 0x14], 0x16de97de
sub esi, edx
xor dword [ebp - 0xc], edx
mov dword [ebx], esi
sub dword [ebp - 0x14], 0xa613324b
add ebx, 4
add edi, 4
loop 0x25802526
add eax, 0xf307
mov ebx, eax
add eax, 5
mov ecx, 0x4affaeb3
add ecx, 0xda80514d
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x2981e5cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x2981e5db
pop dword [ebp - 0x10]
mov eax, 0x50c094cc
add eax, 0xd8c1510f
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x2b508861
sub dword [ebp - 0x20], 0xdcfe4316
mov dword [ebp - 0x1c], 0x985c7c21
sub dword [ebp - 0x1c], 0x66292fdc
mov dword [ebp - 0x18], 0xc3c3813
sub dword [ebp - 0x18], 0xbfeff3e5
mov dword [ebp - 0x14], 0xe6633c72
sub dword [ebp - 0x14], 0xe6633c72
lea eax, [ebp - 0x20]
push eax
mov eax, 0x8f132c77
sub eax, 0x658dabb7
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x99bcc1bf
sub dword [ebp - 0x20], 0x254a5869
mov dword [ebp - 0x1c], 0xb28062c5
sub dword [ebp - 0x1c], 0x71140150
mov dword [ebp - 0x18], 0x311245f0
sub dword [ebp - 0x18], 0xcda2d984
mov dword [ebp - 0x14], 0x19718b58
add dword [ebp - 0x14], 0xe68e74a8
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x71728b66
add eax, 0xb812f552
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x48c78
push 0
call eax
mov ecx, 0x88ff0542
add ecx, 0x77014603
xor edx, edx
add edx, eax
mov esi, 0x29897400
add esi, dword [ebp - 0x10]
mov ebx, 0x253e0a42
sub ebx, 0xfe3e9462
mov edi, dword [esi]
xor dword [ebp - 8], 0xd7db1295
add edi, ebx
xor dword [ebp - 4], ecx
mov dword [edx], edi
sub dword [ebp - 0xc], 0xe093657a
add edx, 4
add esi, 0x6969480
sub esi, 0x696947c
loop 0x2981e6f9
add eax, 0x5822ccac
add eax, 0xa7de533b
xor ebx, ebx
add ebx, eax
add eax, 0xc093a931
add eax, 0x3f6c56d4
mov ecx, 0x132087a8
sub ecx, 0xe9a087a8
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401069
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44b030]
jne 0x401073
repz ret
jmp fcn.00401d51

Function at 0x408f95
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004037cf
and dword [ebp - 4], 0
cmp dword [0x44d88c], 0
mov ebx, eax
jne 0x409046
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4090f7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4090f7
push eax
call fcn.0040375d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44d88c], eax
call esi
push eax
call fcn.0040375d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44d890], eax
call esi
push eax
call fcn.0040375d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44d894], eax
call esi
push eax
call fcn.0040375d
pop ecx
mov dword [0x44d89c], eax
test eax, eax
je 0x409046
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040375d
pop ecx
mov dword [0x44d898], eax
mov eax, dword [0x44d898]
cmp eax, ebx
je 0x40909e
cmp dword [0x44d89c], ebx
je 0x40909e
push eax
call fcn.004037d8
push dword [0x44d89c]
mov esi, eax
call fcn.004037d8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40909e
test edi, edi
je 0x40909e
call esi
test eax, eax
je 0x409095
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409095
test byte [ebp - 0xc], 1
jne 0x40909e
or dword [ebp + 0x10], 0x200000
jmp 0x4090d7
mov eax, dword [0x44d890]
cmp eax, ebx
je 0x4090d7
push eax
call fcn.004037d8
pop ecx
test eax, eax
je 0x4090d7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4090d7
mov eax, dword [0x44d894]
cmp eax, ebx
je 0x4090d7
push eax
call fcn.004037d8
pop ecx
test eax, eax
je 0x4090d7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44d88c]
call fcn.004037d8
pop ecx
test eax, eax
je 0x4090f7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4090f9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402b60
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0xae0064]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x402ba9
push str.SetDefaultDllDirectories
push 0xa9b750
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402ba9
push 0xc00
call eax
test eax, eax
jne 0x402c47
push 0x106
lea eax, [ebp - 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x402c47
cmp eax, 0x104
ja 0x402c47
cmp word [ebp + eax*2 - 0x2d6], 0x5c
je 0x402be7
mov ecx, 0x5c
mov word [ebp + eax*2 - 0x2d4], cx
inc eax
cmp byte [str.userenv], 0
push esi
mov esi, str.userenv
je 0x402c46
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push edi
lea edi, [ebp - 0x2d4]
lea edi, [edi + eax*2]
mov al, byte [esi]
mov ecx, edi
inc esi
test al, al
je 0x402c20
movzx eax, al
mov word [ecx], ax
add ecx, 2
mov al, byte [esi]
inc esi
test al, al
jne 0x402c10
xor eax, eax
mov dword [ecx], 0x64002e
push 8
push eax
mov word [ecx + 8], ax
lea eax, [ebp - 0x2d4]
push eax
mov dword [ecx + 4], 0x6c006c
call ebx
cmp byte [esi], 0
jne 0x402c07
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00a0445c
mov esp, ebp
pop ebp
ret
Function at 0x407e70
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x98
push 0
lea eax, [edi + 0x110]
push eax
call fcn.00a576c0
mov eax, dword [edi + 0x30]
add esp, 0xc
add eax, dword [edi + 0x34]
mov ecx, dword [edi + 0x28]
mov dword [edi + 0x40], eax
mov dword [edi + 0x2c], 0
mov dword [edi + 0x14], 0
lea esi, [ecx + eax]
shr ecx, 3
mov eax, 0xaaaaaaab
mul ecx
mov ecx, 0xc
shr edx, 3
imul eax, edx, 0x54
mov edx, esi
sub edx, eax
mov eax, dword [edi + 0x18]
cmp eax, ecx
mov dword [edi + 0xc], eax
mov dword [edi + 0x44], edx
cmovb ecx, eax
mov dword [edi + 8], edx
not ecx
lea eax, [edx + 0x600]
mov dword [edi + 0x24], ecx
mov dword [edi + 0x20], ecx
lea ecx, [esi - 0xc]
mov dword [edi + 0x38], eax
xor eax, eax
mov dword [edi + 0x3c], ecx
mov dword [edi], ecx
mov dword [edi + 4], ecx
mov dword [ecx + 4], edx
add edx, 2
mov dword [ecx], 0x1010100
mov dword [ecx + 8], 0
mov byte [edx - 2], al
lea edx, [edx + 6]
xor ecx, ecx
mov byte [edx - 7], 1
inc eax
mov dword [edx - 6], ecx
cmp eax, 0x100
jb 0x407f07
lea eax, [edi + 0x9fc]
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
nop word [eax + eax]
mov esi, eax
xor edi, edi
movzx eax, word [edi + 0xa9b780]
lea ecx, [ebx + 2]
xor edx, edx
div ecx
mov ecx, 0x4000
sub ecx, eax
xor eax, eax
movzx ecx, cx
nop
mov word [esi + eax*2], cx
add eax, 8
cmp eax, 0x40
jb 0x407f50
add edi, 2
add esi, 2
cmp edi, 0x10
jb 0x407f34
mov eax, dword [ebp - 4]
inc ebx
sub eax, 0xffffff80
mov dword [ebp - 4], eax
cmp ebx, 0x80
jb 0x407f30
mov edi, dword [ebp + 8]
mov edx, 0x50
pop ebx
lea esi, [edi + 0x3bc]
nop dword [eax + eax]
mov eax, esi
mov ecx, 0x10
nop word [eax + eax]
mov word [eax], dx
lea eax, [eax + 4]
mov word [eax - 2], 0x403
sub ecx, 1
jne 0x407fa0
add edx, 0x28
add esi, 0x40
cmp edx, 0x438
jb 0x407f90
mov dword [edi + 0x3b8], 0x40070000
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4