joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c70
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov al, byte [esp + 0x18]
cmp al, 2
jb 0x401cd7
push 0
push 7
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret
cmp al, 1
push 0
jb 0x401ce9
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret

Function at 0x401d00
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov al, byte [esp + 0x18]
cmp al, 2
jb 0x401d67
push 0
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret
cmp al, 1
push 0
jb 0x401d79
push 4
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret
push 0
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret

Function at 0x401fa0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x401fb8
pop esi
ret
push 4
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x401fc7
pop esi
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
ret
Function at 0x401fe0
Capabilities:
Enumerate processes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40276b
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4020d5
push str.SBroad.exe
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 8]
mov dword [esp + 0x138], 0
push eax
push esi
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4020ba
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll__mbsicmp]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call edi
cmp eax, dword [esp + 0x18]
je 0x402069
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x34]
push ecx
push edx
call ebx
add esp, 8
test eax, eax
je 0x40207a
lea eax, [esp + 0x10]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x402087
jmp 0x40204e
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00401fa0
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xc]
mov dword [esp + 0x140], 0xffffffff
call fcn.004024f4
pop edi
pop ebx
pop esi
mov ecx, dword [esp + 0x12c]
mov dword fs:[0], ecx
add esp, 0x138
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 4]
mov dword [esp + 0x138], 0xffffffff
call fcn.004024f4
mov ecx, dword [esp + 0x130]
pop esi
mov dword fs:[0], ecx
add esp, 0x138
ret
Function at 0x40257e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403160
push 0x4026b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x4041d0], 0xffffffff
or dword [0x4041d4], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x4041c8]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x4041c4]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4041cc], eax
call fcn.004026b5
cmp dword [0x4040e0], 0
jne 0x402601
push 0x4026b2
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.004026a0
push 0x404018
push 0x404014
call sub.MSVCRT.dll__initterm
mov eax, dword [0x4041c0]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x4041bc]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x404010
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.004020f0
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x7b64b5
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x7b64f7
neg ebp
mov dword [esp], ebp
mov ax, bx
pushal
rdtsc
not bx
jmp 0x7b65ad
rdtsc
mov dword [esp], esi
rdtsc
xchg dword [esp], edi
mov al, ah
lea ecx, [esi - 0xdd]
jmp 0x7b64b7
xchg byte [esp + 6], bl
clc
mov si, word [esp + 0x20]
mov ecx, dword [esp + 0x25]
clc
jmp 0x7b65d7
xchg byte [esp + 0xb], cl
lea eax, [edx*4]
mov bx, 0xe005
xchg ecx, ebp
jmp 0x7b657d
push edx
mov bx, 0xf6df
mov edx, ebp
mov di, dx
mov ch, byte [esp + 0x25]
lea ebp, [eax + 0x21]
jmp 0x7b6596
btr edi, esp
mov dl, dh
rcr ah, 1
cpuid
xchg ch, dl
add esp, 9
jmp 0x7b65f7
xchg word [esp + 0x23], si
xchg ah, bl
lea eax, [ebx*4]
inc eax
setae dh
neg bh
jmp 0x7b65c0
xchg di, dx
sub esp, 0x10
push word [esp + 5]
pop word [esp + 0x17]
mov cl, ch
mov byte [esp + 0x1d], dh
jmp 0x7b66ca
lea eax, [esp + edi]
btr edi, esp
xchg bh, cl
lea ecx, [esi*4]
sub esp, 0x10
lea ebp, [esi - 0x65]
jmp 0x7b6658
xchg ebp, eax
lea ecx, [esp + ebp]
mov al, byte [esp]
setl bh
cpuid
lea esi, [edx + esi]
jmp 0x7b6629
mov edx, eax
inc bp
mov bh, byte [esp + 0xb]
mov edi, 0xca7b3d6c
add esp, 1
mov bh, byte [esp + 9]
jmp 0x7b66a9
inc ebp
mov bl, bh
xchg di, si
xchg bh, cl
bsr si, bp
lea ebp, [esi*4]
jmp 0x7b6647
mov ah, byte [esp + 1]
mov dword [esp], ebp
mov word [esp + 7], sp
shr bh, 3
mov dh, byte [esp + 3]
stc
jmp 0x7b6738
mov cx, word [esp + 8]
pop dword [esp]
neg di
inc cx
lea eax, [edx + ebp]
xchg ch, dl
jmp 0x7b6689
mov bx, 0xec23
pushal
lea esp, [esp + 0x4f]
mov si, bx
xchg dx, ax
setne ch
jmp 0x7b6674
invalid
shl ax, cl
push dword [esp + 3]
mov al, 0xe
call fcn.007b6707
movsd dword es:[edi], dword [esi]
sub byte [esi - 0x2a34d727], bh
inc ebp
aad 0xbc
dec edi
scasd eax, dword es:[edi]
je 0x7b66f3
mov ecx, 0xec34b52d
sbb byte [edi - 0x72], ah
imul ebx, dword [ebx], reloc.oleaut32.dll_SysFreeString
mov esp, 0xf70e571d
jno 0x7b6788
ficom word [ecx + edx*2]
shl dword [edi], cl
add byte [eax], al
add byte [eax], al
ljmp 0x52f9
pushal
pop edx
add bh, cl
push edx
pushal
fsubr dword [ecx - 0xd]
inc edi
dec ebp
xor byte [eax + ebx*4 + 0x79], ah
test eax, 0x93354b2
xor ecx, dword [ecx]
fucom st(6)
pushfd
add ecx, dword [ebp]
je 0x7b67c9
push ecx
cmp dword [esi - reloc.oleaut32.dll_SysFreeString], esi
aam 0x45
pop es
push ss
push esi
push ecx
cmc
dec ebx
mov dl, 0x40
pop es
jb 0x7b67f0
mov dword [ecx + 0x37], ebp
xchg eax, eax
sbb byte fs:[0xcf2db256], 0x15
fisubr dword [ebx + 0x1a]
mov bh, 0xf4
loope 0x7b6775
shl byte [eax + eax*4 + 0x1d], 0x56
mov dl, 0x2d
iretd
loope 0x7b6775
add byte [eax], al
add byte [eax], al
lds ecx, [ecx]
retf 0xa1c0
or al, 0x8c
pop edx
or eax, dword [edx + reloc.oleaut32.dll_SysFreeString]
adc eax, 0xe653d5d4
je 0x7b67ad
cmc
sub eax, 0x5e5ad939
ret 0x2dc1
lahf
cmp eax, 0x3069240e
fdivp st(2)
sahf
mov esp, 0x764d8527
pop edx
inc ecx
invalid

Function at 0x7b78a2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bp, bx
pop dword [esp + 4]
mov cx, bx
neg edi
jmp 0x7b787e
Function at 0x7b8014
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [eax*4]
btr edx, edx
pop ebp
xchg bx, ax
xchg ebp, edi
mov cx, word [esp + 0xc]
jmp 0x7b8017
pushal
jmp 0x7b7ff5
bsr si, cx
mov esi, dword [esp + 0x25]
mov esi, eax
bswap edi
mov edx, 0x966fe89c
xchg byte [esp + 0x20], al
jmp 0x7b807d
xchg byte [esp + 0x1a], dl
bswap eax
mov cl, ch
xchg word [esp + 0x15], ax
lea esp, [esp + 7]
push word [esp + 0x15]
jmp 0x7b80cb
mov ebx, 0x4a5ad99a
mov ebp, 0x1720e2a2
push dword [esp + 0x30]
pop cx
mov ebx, 0x114f4e8e
bsr bx, cx
jmp 0x7b8053
push word [esp + 7]
lea edi, [eax*4]
lea ecx, [edx + esi]
mov byte [esp + 0x2e], ch
jmp 0x7b80e9
not si
not ax
lea esi, [ebp*4]
xchg word [esp + 7], di
jmp 0x7b80b2
push word [esp + 0x21]
cpuid
pushal
lea esp, [esp + 0x52]
mov cx, sp
bsf ax, ax
jmp 0x7b8159
mov si, word [esp]
xchg ah, bl
lea esp, [esp + 1]
neg dh
inc bl
xchg ch, dl
jmp 0x7b8121
rdtsc
inc edx
neg si
mov edi, 0xfe306afe
sub esp, 2
lea ebp, [esp + edx]
jmp 0x7b813d
Function at 0x7b816c
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor bx, 0xcf2c
mov dword [esp + 4], ebp
pop word [esp + 2]
jmp 0x7b81f0
add al, dh
pop bp
add esp, 0xa
mov eax, ecx
mov dl, 0x6c
xchg byte [esp], al
jmp 0x7b8222
pop word [esp + 0xc]
lea ecx, [edi + edi]
xchg dx, bp
mov ax, word [esp + 4]
mov esi, dword [esp + 0xc]
mov ax, word [esp + 2]
jmp 0x7b81ce
xchg dword [esp], edx
mov ax, 0x4ea5
cpuid
mov dx, di
lea esp, [esp + 2]
jmp 0x7b8236
mov bp, word [esp + 4]
clc
mov bl, bh
setl ch
mov ah, byte [esp + 3]
mov dx, di
jmp 0x7b820b
not si
btr ebp, edx
pushal
rdtsc
lea ebx, [eax*4]
setle ah
jmp 0x7b835a
mov esi, dword [esp]
bsf bx, si
push word [esp + 1]
mov dh, byte [esp + 4]
xchg dword [esp], edx
xchg dword [esp], edi
jmp 0x7b8304
lea ecx, [esi - 0xe5]
lea esp, [esp + 0x1a]
pop word [esp + 1]
mov eax, dword [esp + 2]
lea edi, [eax - 9]
pop eax
jmp 0x7b8271
mov edi, 0x75d1b898
mov si, 0x3c21
xchg ah, bl
jmp 0x7b833b
mov edx, esi
xchg si, ax
mov di, word [esp + 0xe]
mov word [esp + 0xa], bx
mov ecx, 0x23d414ca
xchg bx, ax
jmp 0x7b82aa
lea ecx, [ecx + edx]
xchg dword [esp + 1], edx
xchg ah, bl
mov ebx, esi
cmc
mov bp, word [esp + 0xc]
jmp 0x7b82c0
bsr bx, bp
pushal
pop cx
xchg edi, eax
mov ebx, dword [esp + 0x22]
stc
jmp 0x7b82dd
lea edi, [esp + edx]
mov bx, sp
inc dl
sub esp, 0x10
lea ebp, [edi + edi]
pop di
jmp 0x7b8470
lea ecx, [eax*4]
bswap edx
mov esi, 0x911d14b4
mov eax, dword [esp]
rdtsc
popal
jmp 0x7b8314
mov word [esp], di
btr esi, edx
mov word [esp + 0x14], dx
bswap edi
mov eax, 0xca1327a6
cpuid
jmp 0x7b8291
xor ebx, esi
mov dx, word [esp + 0xa]
pop ax
xchg esi, ebx
cpuid
cmc
jmp 0x7b8403
mov eax, dword [esp + 6]
lea ebx, [eax + ebx]
xchg esi, ebp
mov cx, 0xf183
lea eax, [esp + ebx]
setp ah
jmp 0x7b8374
mov cx, 0xa9c7
mov eax, dword [esp + 3]
call fcn.007b83a4
add byte [0xe40ffc95], 0x3c
mov dh, 0x24
inc ebx
mov esi, 0xd94e275c
mov ah, byte [esp + 1]
pop edi
lea ecx, [eax*4]
xchg bh, cl
jmp 0x7b83cf
rcl cx, cl
xchg dword [esp + 5], edi
xchg ch, dl
mov word [esp + 4], bx
mov cx, word [esp + 2]
add esp, 3
jmp 0x7b83eb
mov edi, 0xae3072d8
mov dl, dh
lea eax, reloc.oleaut32.dll_SysFreeString
pop edx
not ch
mov dword [esp], ebp
jmp 0x7b838f

Function at 0x7b83a4
Capabilities:
Parse pe header

Disassembly:
add dx, 0xfd7e
sub esp, 0x10
lea edi, [esi - 0xc5]
cpuid
jmp 0x7b8440
push dword [esp + 0x14]
neg bp
clc
mov dword [esp + 0x1b], esi
add esp, 0x11
jmp 0x7b841b
xchg bx, si
mov eax, 0xc0827228
xchg byte [esp + 6], dl
xchg word [esp + 0x19], bp
popal
mov bp, word [esp + 3]
jmp 0x7b8456
mov ax, dx
mov dl, dh
sub esp, 0x1e
mov byte [esp + 0x2e], ah
pop eax
xchg byte [esp + 6], dl
jmp 0x7b83b9
xchg di, ax
bswap esi
mov word [esp], bx
sub esp, 2
mov dl, 0x8c
xchg si, cx
jmp 0x7b87c5
rcl ax, cl
push word [esp]
xchg ebx, ebp
xchg dword [esp], edx
call fcn.007b86a5
mov cl, 0xa
sub ax, 0xdbd8
xchg ah, bl
pop eax
mov word [esp], sp
cpuid
jmp 0x7b879e
Function at 0x7b85ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp + 0x1a], si
mov dh, byte [esp + 7]
mov di, word [esp + 0x34]
mov ebp, dword [esp + 0x14]
bswap edi
jmp 0x7b8673
push word [esp + 0x20]
pop dword [esp + 0x28]
push dword [esp + 0x20]
jmp 0x7b8599
inc bx
cmc
xchg bh, cl
mov edi, ebp
rdtsc
jmp 0x7b85b3
mov ch, byte [esp + 0x10]
rdtsc
mov dword [esp], eax
mov ch, byte [esp + 0x11]
mov byte [esp + 1], dh
call int.007b8610
cmpsd dword [esi], dword es:[edi]
aaa
cmpsd dword [esi], dword es:[edi]
ret 0x8a31
neg di
push word [esp + 0xf]
rdtsc
xchg byte [esp], cl
mov byte [esp + 9], dh
pop word [esp + 0xf]
jmp 0x7b85d5
xchg word [esp + 0xc], di
setp ch
setae bh
pop word [esp + 0x27]
popal
lea ebx, reloc.oleaut32.dll_SysFreeString
jmp 0x7b85f8
setne bh
mov al, ah
ror edx, 3
mov bp, 0xebd7
xchg esi, eax
cpuid
jmp 0x7b8635

Function at 0x7b87af
Capabilities:
Parse pe header

Disassembly:
push esp
mov dword [esp + 3], esi
call fcn.007b8a47
push 0xffffffffffffffee
jl 0x7b87d8
neg byte [eax]
jg 0x7b8807
int1
ljmp 0xdbd8
je fcn.007b87fe
add dword [esi - 1], esp
je 0x7b8803
add eax, 0x24648d52
add cl, byte [ecx + 0x54442474]
push word [esp + 5]
call 0x7b8825
in al, 0x6d
add eax, 0x18e8
add ah, ah
insd dword es:[edi], dx
std
test byte [edi - 0x2e], dh
idiv byte [esi - 0x14]
mov eax, dword [esi - reloc.oleaut32.dll_SysFreeString]

Function at 0x7b87fe
Capabilities:
Parse pe header

Disassembly:
call fcn.007b8033
push word [esp + 1]
push word [esp + 5]
push edx
lea esp, [esp + 2]
mov dword [esp + 0x44], esi
push esp
jmp 0x7b881c
mov dword [esp], eax
jmp 0x7b87d6
mov word [esp], bx
call 0x7b8803
lea esp, [esp + 2]
mov dword [esp + 0x4c], edi
lea esp, [esp + 0x4c]
jmp 0x7b887a
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x7b802e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x7b885d

Function at 0x7b8803
Capabilities:
Parse pe header

Disassembly:
push esp
mov dword [esp + 3], esi
call fcn.007b8a47
push 0xffffffffffffffee
jl 0x7b87d8
neg byte [eax]
jg 0x7b8807
int1
ljmp 0xdbd8
je fcn.007b87fe
add dword [esi - 1], esp
je 0x7b8803
add eax, 0x24648d52
add cl, byte [ecx + 0x54442474]
push word [esp + 5]
call 0x7b8825
in al, 0x6d
add eax, 0x18e8
add ah, ah
insd dword es:[edi], dx
std
test byte [edi - 0x2e], dh
idiv byte [esi - 0x14]
mov eax, dword [esi - reloc.oleaut32.dll_SysFreeString]

Function at 0x7b8825
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.007b8033
push word [esp + 1]
push word [esp + 5]
push edx
lea esp, [esp + 2]
mov dword [esp + 0x44], esi
push esp
jmp 0x7b881c
mov dword [esp], eax
jmp 0x7b87d6
mov word [esp], bx
call 0x7b8803
lea esp, [esp + 2]
mov dword [esp + 0x4c], edi
lea esp, [esp + 0x4c]
jmp 0x7b887a
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x7b802e
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x7b885d

Function at 0x7b88a5
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 5], ecx
lea esp, [esp + 2]
mov dword [esp + 0x3c], ebp
push edx
pop word [esp]
call fcn.007b87fe
push word [esp + 1]
push esp
pop word [esp + 3]
push word [esp + 7]
jmp 0x7b8847
Function at 0x7b8a47
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 3]
mov dword [esp + 0x38], esp
call fcn.007b88a5
das
mov edi, 0x72b94a2f
pop es
nop
push es
popal
nop
cmp dword [ebx + reloc.oleaut32.dll_SysFreeString], ebx
mov dword [reloc.oleaut32.dll_SysFreeString], eax
cmpsb byte [esi], byte es:[edi]
movq mm6, qword [esi + 0x61]
push word [esp + 7]
lea esp, [esp + 1]
mov word [esp], di
mov word [esp + 3], dx
mov byte [esp + 0xf], ch
pop word [esp + 6]
jmp 0x7b88d4
mov dword [esp + 1], ebp
push edx
jmp 0x7b89c3

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403bf6
Capabilities:
Encrypt data using tea

Disassembly:
sub esp, 0x28
and dword [esp + 8], 0
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], edi
mov eax, dword [edi]
mov ebp, dword [edi + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x30], eax
call fcn.00403281
mov ebx, dword [esp + 0x18]
mov eax, dword [esi + 0xc]
add ebx, 0x23f
mov edi, dword [esi + 8]
push 0x20
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x2c], eax
pop esi
mov dword [esp + 0x20], 2
add dword [esp + 0x20], 3
mov edx, dword [esp + 0x1c]
mov eax, edx
shl eax, 4
add eax, edi
mov dword [esp + 0x24], 0xedeb2e40
cmp dword [0x6765a4], 0xfa9
mov dword [esp + 0x10], eax
lea ecx, [ebx + edx]
mov eax, dword [0x6765e8]
cmove eax, dword [esp + 0x24]
and dword [esp + 0x24], 0
cmp dword [0x6765a4], 0x3eb
mov dword [0x6765e8], eax
mov eax, dword [0x6765f0]
cmove eax, dword [esp + 0x24]
mov dword [0x6765f0], eax
mov eax, dword [esp + 0x1c]
shr eax, 5
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x28]
xor eax, ecx
mov dword [0x6765ec], 0xf4ea3dee
xor eax, dword [esp + 0x10]
sub ebp, eax
mov dword [esp + 0x14], eax
mov eax, ebp
shl eax, 4
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
add dword [esp + 0x10], eax
mov ecx, dword [esp + 0x20]
mov eax, ebp
shr eax, cl
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x30]
add dword [esp + 0x14], eax
lea eax, [ebx + ebp]
xor eax, dword [esp + 0x14]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x1c], eax
mov edx, 0x9e3779b9
lea ecx, [esp + 0x18]
call fcn.00403bea
dec esi
je 0x403d1d
mov ebx, dword [esp + 0x18]
jmp 0x403c44
mov edi, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
mov dword [edi + 4], ebp
mov dword [edi], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x41243f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43fe88]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407976
mov dword [ebp - 0x14], eax
cmp dword [0x67765c], esi
jne 0x412532
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4124bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x412612
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x412612
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x412612
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x67765c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x677660], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x677664], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x67766c], eax
test eax, eax
je 0x41252f
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x677668], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x412557
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41254a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41256c
push 4
pop eax
jmp 0x412614
cmp dword [ebp - 0x14], esi
je 0x41256c
push dword [0x67765c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x412551
mov eax, dword [0x677668]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4125ca
cmp dword [0x67766c], edi
je 0x4125ca
push eax
call ebx
push dword [0x67766c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4125ca
test eax, eax
je 0x4125ca
call ecx
test eax, eax
je 0x4125bf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4125bf
test byte [ebp - 8], 1
jne 0x4125ca
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4125fa
mov eax, dword [0x677660]
cmp eax, edi
je 0x4125f7
push eax
call ebx
test eax, eax
je 0x4125f7
call eax
mov esi, eax
test esi, esi
je 0x4125f7
mov eax, dword [0x677664]
cmp eax, edi
je 0x4125f7
push eax
call ebx
test eax, eax
je 0x4125f7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x67765c]
call ebx
test eax, eax
je 0x412612
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x412614
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406bb0
mov esp, ebp
pop ebp
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430003
Capabilities:
Authenticate hmac
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..00cfg
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x5e7c5494
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x3a65565b
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219