joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438920
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section..data
lea edi, [esi - 0x29000]
push edi
or ebp, 0xffffffff
jmp 0x438942
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x438949
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x438938
mov eax, 1
add ebx, ebx
jne 0x43895b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x438950
jne 0x43896c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x438950
xor ecx, ecx
sub eax, 3
jb 0x438980
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4389f2
mov ebp, eax
add ebx, ebx
jne 0x43898b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x438998
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4389bc
inc ecx
add ebx, ebx
jne 0x4389a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43899d
jne 0x4389b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43899d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4389dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4389cd
jmp 0x43893e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4389dc
add edi, ecx
jmp 0x43893e
pop esi
mov edi, esi
mov ecx, 0xdda
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4389fa
cmp byte [edi], 9
jne 0x4389fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4389ff
lea edi, [esi + 0x36000]
mov eax, dword [edi]
or eax, eax
je 0x438a6e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x388fc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x389ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x438a2c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x389b4]
or eax, eax
je 0x438a68
mov dword [ebx], eax
add ebx, 4
jmp 0x438a49
call dword [esi + 0x389b0]
mov ebp, dword [esi + 0x389b8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x438aa2
sub esp, 0xffffff80
jmp 0x42418c
Function at 0x401310
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x406008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
push esi
push 0
push 0x42a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x230], eax
test eax, eax
jne 0x401351
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403032
mov esp, ebp
pop ebp
ret
push edi
push esi
push 8
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
xor esi, esi
mov dword [ebp - 0x22c], edi
test edi, edi
je 0x4013f3
push 0x220
lea eax, [ebp - 0x224]
mov dword [ebp - 0x228], 0x224
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x228]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x4013ec
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test esi, esi
jne 0x4013e6
lea eax, [ebp - 0x208]
push ebx
push eax
call edi
add esp, 8
test eax, eax
je 0x4013ca
lea eax, [ebp - 0x108]
push ebx
push eax
call edi
add esp, 8
test eax, eax
jne 0x4013cf
mov esi, 1
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x22c]
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x4013a4
mov edi, dword [ebp - 0x22c]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403032
mov esp, ebp
pop ebp
ret
Function at 0x401420
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x406008]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x13c], ebx
cmp ebx, 0xffffffff
je 0x401561
lea eax, [ebp - 0x134]
mov dword [ebp - 0x134], 0x128
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x40155a
mov ecx, dword [0x4063f4]
xor eax, eax
mov edx, dword [0x4063f0]
sub ecx, edx
sar ecx, 2
mov byte [ebp - 0x135], 0
test ecx, ecx
je 0x4014a8
mov esi, dword [ebp - 0x12c]
cmp dword [edx + eax*4], esi
je 0x4014a1
inc eax
cmp eax, ecx
jb 0x401495
jmp 0x4014a8
mov byte [ebp - 0x135], 1
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4014b1
mov eax, dword [ebp + 8]
sub ecx, edx
mov edx, eax
cmp dword [eax + 0x14], 0x10
jb 0x4014c7
mov edx, dword [eax]
mov ebx, dword [eax + 0x10]
lea edi, [ebp - 0x110]
cmp ecx, ebx
mov esi, ebx
cmovb esi, ecx
sub esi, 4
jb 0x4014f1
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x4014f6
add edx, 4
add edi, 4
sub esi, 4
jae 0x4014e0
cmp esi, 0xfffffffc
je 0x40152a
mov al, byte [edx]
cmp al, byte [edi]
jne 0x401523
cmp esi, 0xfffffffd
je 0x40152a
mov al, byte [edx + 1]
cmp al, byte [edi + 1]
jne 0x401523
cmp esi, 0xfffffffe
je 0x40152a
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
jne 0x401523
cmp esi, 0xffffffff
je 0x40152a
mov al, byte [edx + 3]
cmp al, byte [edi + 3]
je 0x40152a
sbb eax, eax
or eax, 1
jmp 0x40152c
xor eax, eax
test eax, eax
jne 0x40153e
cmp ebx, ecx
jb 0x40153e
ja 0x40153e
cmp byte [ebp - 0x135], al
je 0x401576
mov ebx, dword [ebp - 0x13c]
lea eax, [ebp - 0x134]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x401471
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00403032
mov esp, ebp
pop ebp
ret 4
push dword [ebp - 0x13c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x12c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00403032
mov esp, ebp
pop ebp
ret 4
Function at 0x4039a1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4039e0
mov ecx, memmove
cmp word [eax], cx
jne 0x4039e0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4039e0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4039e0
cmp dword [ecx + 0x74], 0xe
jbe 0x4039e0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x43c7e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x43c805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x43c878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x43c83a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x43c86d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x43c86b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x43c831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x43c7fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x40db80
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4143d8], 0
jne 0x40dc01
cmp dword [0x4143f8], 0
jne 0x40dbb0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4143f8], eax
test eax, eax
jne 0x40dbb0
push str.GetEnvironmentStrings_failed
call fcn.0040cbf0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4143f8]
jmp 0x40dbc4
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dbbc
lea edi, [ebp + 1]
push edi
call fcn.00405c3c
pop ecx
mov ebx, eax
mov dword [0x4143dc], ebx
test ebx, ebx
jne 0x40dbee
xor eax, eax
jmp 0x40dcc4
push edi
mov edx, dword [0x4143f8]
push edx
push ebx
call fcn.004069b8
add esp, 0xc
jmp 0x40dc21
xor esi, esi
mov ebx, dword [0x4143d8]
jmp 0x40dc1b
push eax
call fcn.00406b08
pop ecx
test eax, eax
jne 0x40dc17
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc0b
lea ebx, [esi + 4]
push 4
mov dword [0x4143e0], ebx
inc ebx
push ebx
call fcn.00405a3c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40dc44
xor eax, eax
jmp 0x40dcc4
cmp dword [0x4143d8], 0
jne 0x40dc75
xor esi, esi
mov ebx, dword [0x4143dc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40dc66
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dc5c
jmp 0x40dca6
xor esi, esi
mov ebx, dword [0x4143d8]
mov eax, dword [esp]
mov edi, eax
jmp 0x40dca0
push eax
call fcn.00406b08
pop ecx
test eax, eax
je 0x40dc95
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40dc99
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc84
mov eax, dword [0x4143d8]
test eax, eax
je 0x40dcb6
push eax
call fcn.00405c4c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4143d8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x10063f34
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x2c]
jne 0x10077a6a
jmp 0x10066a81
mov al, ch
mov al, 0x31
mov byte [edi - 1], 0
mov ax, 0xe712
pushfd
not ax
mov dword [esp], ebx
movzx ax, cl
mov ax, 0xbd8d
lea eax, [eax - 0x5c285a2]
lea eax, [0x10077288]
push 0xd24c8398
push 0xd2e4d8a2
mov dword [esp + 4], 0x100664b6
call fcn.10066c1e
dec edi
jno 0x10066a65
sub al, 0x42
das
lodsb al, byte [esi]
dec edi
jne 0x10066aca
pop esp
dec eax
dec eax
sbb ecx, dword [edx]
aas
push cs
lcall 0xf268, 0xbccd5db0
movsb byte es:[edi], byte [esi]
pop es
mov esp, 0xf6a41628
lodsb al, byte [esi]
loope 0x10066b57
adc eax, 0x5d736a18
jecxz 0x10066aca
sbb byte [ebp + ebp*8 + 0x3b5262cb], al
xlatb
adc dword [ecx - 0x5044db4f], eax
wait
or bh, byte [edi + 0x46]
mov ecx, dword [edx - 0x1964a622]
fcmovne st(0), st(5)
mov al, 0xf2
jl 0x10066acb
and dword [eax + 0x76], ebx
adc dword [eax], edi
mov edi, 0xc7fc49f9
movsd dword es:[edi], dword [esi]
fdiv qword [esi + 0x5080a6a0]
push esp
fmul dword [ebx - 0x90f9d50]
mov ch, 0x76
or byte [edi + 0xc0a7c41], al
sub bh, byte [ebx - 0x6d2acc37]
dec edx
sar al, cl
mov bl, 0xdf
invalid
pop ecx
aad 0xde
xor al, ah
shld ax, sp, cl
pop eax
jmp 0x10064115
Function at 0x405ad6
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x58]
sub esp, 0xbc
push esi
mov esi, dword [ebp + 0x6c]
push edi
push 0x40
pop eax
cmp esi, eax
jae 0x405aef
mov eax, esi
push eax
push dword [ebp + 0x68]
lea eax, [ebp - 0x44]
push eax
call fcn.0041c000
add esp, 0xc
lea eax, [ebp + 0x20]
push eax
mov byte [ebp + esi - 0x44], 0
mov byte [ebp + esi - 0x43], 0
mov byte [ebp + esi - 0x42], 0
mov byte [ebp + esi - 0x41], 1
add esi, 4
push esi
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.00405999
push 0x20
pop esi
push esi
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp]
push eax
call fcn.0041c000
mov eax, dword [ebp + 0x7c]
add esp, 0xc
dec eax
mov dword [ebp + 0x4c], eax
push 0x10
pop eax
mov dword [ebp + 0x50], eax
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x70]
mov dword [ebp + 0x40], eax
mov eax, dword [ebp + 0x74]
mov dword [ebp + 0x44], eax
mov eax, dword [ebp + 0x78]
mov dword [ebp + 0x48], eax
xor edi, edi
mov eax, dword [ebp + edi + 0x4c]
test eax, eax
jbe 0x405ba6
mov dword [ebp + 0x6c], eax
lea eax, [ebp - 0x64]
push eax
push esi
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.00405999
push esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.0041c000
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax + 0x20]
xor byte [ebp + eax], cl
inc eax
cmp eax, esi
jb 0x405b94
dec dword [ebp + 0x6c]
jne 0x405b6d
push esi
lea eax, [ebp]
push eax
push dword [ebp + edi + 0x40]
call fcn.0041c000
add edi, 4
add esp, 0xc
cmp edi, 0xc
jb 0x405b62
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.0040ce55
push esi
lea eax, [ebp]
push eax
call fcn.0040ce55
push esi
lea eax, [ebp + 0x20]
push eax
call fcn.0040ce55
push esi
lea eax, [ebp - 0x64]
push eax
call fcn.0040ce55
pop edi
pop esi
add ebp, 0x58
leave
ret 0x20

Function at 0x405ebb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 2
jne 0x405f07
mov eax, dword [esi + 4]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp + 8]
push eax
push 0x20
push dword [ebp + 0xc]
call fcn.00405999
xor edx, edx
mov dword [esi + 4], edx
xor eax, eax
push ebx
movzx ebx, byte [ebp + eax - 0x20]
mov ecx, eax
and ecx, 3
shl ecx, 3
shl ebx, cl
xor edx, ebx
inc eax
cmp eax, 0x20
jb 0x405eec
mov dword [esi + 4], edx
pop ebx
cmp dword [esi], 3
jne 0x405f2f
lea eax, [ebp - 0x20]
push eax
push 0x20
add esi, 4
push esi
push 0x20
push dword [ebp + 0xc]
call fcn.00405999
push 0x20
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.0041c000
add esp, 0xc
pop esi
leave
ret 8
Function at 0x408fad
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0041a860
push ebx
push esi
push dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
call esi
test eax, eax
setne bl
test bl, bl
jne 0x408ffc
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.0040a77b
test al, al
je 0x408ffc
push dword [ebp + 0xc]
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
setne bl
pop esi
mov al, bl
pop ebx
leave
ret 8

Function at 0x409396
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1250
call fcn.0041a860
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
lea eax, [ebp - 0x250]
mov edi, 0x800
push eax
jne 0x409425
push dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
call ebx
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x409452
push edi
lea eax, [ebp - 0x1250]
push eax
push dword [ebp + 0xc]
call fcn.0040a77b
test al, al
je 0x4093fe
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x1250]
push eax
call ebx
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x409452
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x409418
cmp eax, 3
je 0x409418
cmp eax, 0x12
je 0x409418
xor eax, eax
inc eax
jmp 0x40941a
xor eax, eax
mov byte [esi + 0x1044], al
jmp 0x40951d
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x409448
or dword [ebp + 8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne al
mov byte [esi + 0x1044], al
cmp dword [ebp + 8], 0xffffffff
je 0x40951d
push edi
push dword [ebp + 0xc]
push esi
call fcn.00410951
push edi
lea eax, [ebp - 0x224]
push eax
push esi
call fcn.0040a40a
push 1
push 0
push 0
push dword [ebp - 0x234]
call fcn.0041a940
mov ecx, dword [ebp - 0x230]
xor edi, edi
add eax, ecx
mov dword [esi + 0x1000], eax
mov eax, dword [ebp - 0x250]
mov dword [esi + 0x1008], eax
mov eax, dword [ebp - 0x24c]
mov dword [esi + 0x1028], eax
mov eax, dword [ebp - 0x248]
mov dword [esi + 0x102c], eax
mov eax, dword [ebp - 0x244]
mov dword [esi + 0x1030], eax
mov eax, dword [ebp - 0x240]
mov dword [esi + 0x1034], eax
mov eax, dword [ebp - 0x23c]
mov dword [esi + 0x1038], eax
mov eax, dword [ebp - 0x238]
mov dword [esi + 0x103c], eax
lea eax, [ebp - 0x23c]
adc edx, edi
push eax
lea ecx, [esi + 0x1010]
mov dword [esi + 0x1004], edx
call fcn.004110a4
lea eax, [ebp - 0x24c]
push eax
lea ecx, [esi + 0x1018]
call fcn.004110a4
lea eax, [ebp - 0x244]
push eax
lea ecx, [esi + 0x1020]
call fcn.004110a4
and dword [esi + 0x1040], 0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x410463
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret 4
Function at 0x410fc5
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
cmp dword [esi], ebp
jbe 0x411040
push ebx
push edi
lea edi, [esi + 4]
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x410f67
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x41101c
push str.CreateThread_failed
push 0x4325ac
call fcn.004063ad
pop ecx
pop ecx
mov ecx, 0x4325ac
call fcn.00401000
push 2
mov ecx, 0x4325ac
call fcn.00406353
mov dword [edi], ebx
inc dword [esi + 0x84]
mov eax, dword [0x44e58c]
test eax, eax
je 0x411036
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc ebp
add edi, 4
cmp ebp, dword [esi]
jb 0x410fd5
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret

Function at 0x418738
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x418773
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x41875a
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x41876b
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x418775
inc edi
add eax, 0x28
cmp edi, esi
jb 0x418750
xor eax, eax
pop edi
pop esi
ret

Function at 0x419b88
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
call [esi - 0x3a]
test ebp, esp
clc
invalid
dec dword [ecx - 0x3a]
test esi, esp
clc
invalid
invalid
cmp eax, 0xffeb17e8
jmp dword [esi]
pushal
scasb al, byte es:[edi]
mov edx, 0xf8d4858d
invalid
Function at 0x41a767
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 1
pop eax
test eax, eax
je 0x41a79e
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x41a273
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
clc
invalid
inc dword [eax]
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
mov byte [ebp - 0x76d], 0xbd
mov byte [ebp - 0x76c], 0x92
mov byte [ebp - 0x76b], 0x97
mov byte [ebp - 0x76a], 0x9e
mov byte [ebp - 0x769], 0x88
mov byte [ebp - 0x768], 0xa7
test dword [eax - 0x58000008], ebx
mov byte [ebp - 0x767], 0xb8
mov byte [ebp - 0x766], 0x94
mov byte [ebp - 0x765], 0x96
mov byte [ebp - 0x764], 0x96
mov byte [ebp - 0x763], 0x94
mov byte [ebp - 0x762], 0x95
clc
invalid
call dword [ebp - 0x7607a3a]
invalid
invalid
fcmovnb st(0), st(6)
test dword [eax - 0x42000008], esp
mov byte [ebp - 0x75f], 0x92
mov byte [ebp - 0x75e], 0x97
mov byte [ebp - 0x75d], 0x9e
cmp dword [ebp - 0x6fc], 1
je 0x41a78e
lea eax, [ebp - 0x714]
push eax
call fcn.00418708
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.004186bd
add esp, 0xc
mov dword [ebp - 0x37c], eax
invalid
invalid
invalid

Function at 0x41e48e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f298]
jne 0x41e498
repz ret
jmp fcn.00423c33
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b004]
jne 0x40100a
repz ret
jmp fcn.00401647

Function at 0x4071c9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404019
and dword [ebp - 0x14], 0
cmp dword [0x42dd84], 0
mov dword [ebp - 0x18], eax
jne 0x40727c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x407324
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x407324
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42dd84], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42dd88], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42dd8c], eax
call edi
push eax
call esi
mov dword [0x42dd94], eax
test eax, eax
je 0x40727c
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42dd90], eax
mov eax, dword [0x42dd90]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4072d5
cmp dword [0x42dd94], ecx
je 0x4072d5
push eax
call esi
push dword [0x42dd94]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4072d5
test ebx, ebx
je 0x4072d5
call edi
test eax, eax
je 0x4072cc
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4072cc
test byte [ebp - 8], 1
jne 0x4072d5
or dword [ebp + 0x10], 0x200000
jmp 0x407308
mov eax, dword [0x42dd88]
cmp eax, dword [ebp - 0x18]
je 0x407308
push eax
call esi
test eax, eax
je 0x407308
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x407308
mov eax, dword [0x42dd8c]
cmp eax, dword [ebp - 0x18]
je 0x407308
push eax
call esi
test eax, eax
je 0x407308
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42dd84]
call esi
test eax, eax
je 0x407324
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x407326
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x427920
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x808
mov eax, dword [0x42b004]
xor eax, esp
mov dword [esp + 0x804], eax
mov eax, dword [0x42e2a4]
imul eax, eax, 0x343fd
cmp dword [0x22d0e8c], 0x139e
mov dword [0x42e2a4], eax
jne 0x427973
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTapePosition]
mov eax, dword [esp]
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_GetAce]
mov eax, dword [0x42e2a4]
add eax, 0x269ec3
push esi
mov dword [0x42e2a4], eax
movzx esi, word [0x42e2a6]
and esi, 0x7fff
cmp dword [0x22d0e8c], 0x8e7
jne 0x4279a8
push 0
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [esp + 0x808]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401000
add esp, 0x808
ret

Function at 0x427a30
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x42b004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x42c1f0]
push ebx
mov ebx, dword [0x22d0830]
push edi
mov edi, dword [0x22d0e8c]
call fcn.004279c0
cmp dword [0x22d0e8c], 0x2f
jne 0x427a95
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.004279f0
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.00401000
add esp, 0x24
ret