joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402120
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x100
lea eax, [esp]
mov dword [esp], 0x73996554
push 0x100
push eax
mov dword [esp + 0xc], 0xd618857f
mov dword [esp + 0x10], 0xe8ecf0bc
mov dword [esp + 0x14], 0xb6d87b6e
mov dword [esp + 0x18], 0x73e62a42
mov dword [esp + 0x1c], 0x4f76e282
mov dword [esp + 0x20], 0x2b698ce8
mov dword [esp + 0x24], 0x1f049900
mov dword [esp + 0x28], 0xc55b104b
mov dword [esp + 0x2c], 0xb737ee1a
mov dword [esp + 0x30], 0x78252d6e
mov dword [esp + 0x34], 0x2fd7e83e
mov dword [esp + 0x38], 0xb50a5f35
mov dword [esp + 0x3c], 0x1168499f
mov dword [esp + 0x40], 0x218d4a8a
mov dword [esp + 0x44], 0xd89065ad
mov dword [esp + 0x48], 0x284c410c
mov dword [esp + 0x4c], 0x4c7c22f0
mov dword [esp + 0x50], 0x8ca8b4f9
mov dword [esp + 0x54], 0xe0e8bc85
mov dword [esp + 0x58], 0x53cf8e6c
mov dword [esp + 0x5c], 0xd296aea8
mov dword [esp + 0x60], 0x99f1b8e4
mov dword [esp + 0x64], 0xab40d9a6
mov dword [esp + 0x68], 0xd5a57657
mov dword [esp + 0x6c], 0x912032b1
mov dword [esp + 0x70], 0x2538ef66
mov dword [esp + 0x74], 0xca55974e
mov dword [esp + 0x78], 0xc0133ef4
mov dword [esp + 0x7c], 0x89c4564b
mov dword [esp + 0x80], 0xa7d6a9e3
mov dword [esp + 0x84], 0xe85be9e6
mov dword [esp + 0x88], 0xacf9b45a
mov dword [esp + 0x8c], 0xa2dfbe02
mov dword [esp + 0x90], 0x929a31be
mov dword [esp + 0x94], 0x93959c08
mov dword [esp + 0x98], 0x74e5d3de
mov dword [esp + 0x9c], 0x917cac49
mov dword [esp + 0xa0], 0x8a8daa24
mov dword [esp + 0xa4], 0x819a0002
mov dword [esp + 0xa8], 0x17c79de7
mov dword [esp + 0xac], 0x6d6d5a43
mov dword [esp + 0xb0], 0xc3f54c14
mov dword [esp + 0xb4], 0xd79da53
mov dword [esp + 0xb8], 0x1f9282db
mov dword [esp + 0xbc], 0x602b1a5b
mov dword [esp + 0xc0], 0x47733689
mov dword [esp + 0xc4], 0x6de3cb27
mov dword [esp + 0xc8], 0x165df086
mov dword [esp + 0xcc], 0xf3b5498f
mov dword [esp + 0xd0], 0xba612241
mov dword [esp + 0xd4], 0x3a06f025
mov dword [esp + 0xd8], 0x7f4fdb5a
mov dword [esp + 0xdc], 0x1e0889b7
mov dword [esp + 0xe0], 0x673de1c9
mov dword [esp + 0xe4], 0x5273f8d7
mov dword [esp + 0xe8], 0xeefde6e4
mov dword [esp + 0xec], 0x438bf1e4
mov dword [esp + 0xf0], 0x35deb8b0
mov dword [esp + 0xf4], 0x4b72d5ad
mov dword [esp + 0xf8], 0x403e24f5
mov dword [esp + 0xfc], 0x39401469
mov dword [esp + 0x100], 0x1e8d7724
mov dword [esp + 0x104], 0x32165d3
call fcn.004039e0
push 0x4d1050
push 0x100
lea eax, [esp + 0x10]
push eax
push 0x345e00
push 0x4d1050
call fcn.004038b0
mov eax, dword [esp + 0x120]
mov dword [eax], 0x4d1050
add esp, 0x11c
ret
Function at 0x4032f0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
lea edx, [ebp + 0x10]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x403318
mov eax, dword [ebp + 0x10]
lea edx, [ebp + 0x18]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0xc], eax
jmp 0x403326
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
test ecx, ecx
jle 0x40333f
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x40334d
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
test ecx, ecx
jle 0x403366
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x403374
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
jle 0x40338d
dec ecx
add edx, 8
mov dword [ebp + 0xc], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x40339b
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov eax, edx
mov dword [ebp - 0x30], 0
cdq
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call 0x4033e2
add dword [esp], 5
retf

Function at 0x403470
Capabilities:
Check os version

Disassembly:
mov ecx, 1
mov edx, 0x8178e8
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x403599
cmp dword fs:[0xc0], eax
je 0x40349b
mov dword [0x8178e4], 1
mov eax, dword fs:[0x18]
push ebx
push esi
mov ebx, 1
mov esi, dword [eax + 0x30]
mov eax, dword [esi + 0xa4]
mov dword [0x8177cc], eax
mov eax, dword [esi + 0xa8]
mov dword [0x8177d0], eax
movzx edx, word [esi + 0xac]
mov dword [0x8177d4], edx
mov eax, dword [esi + 0xb0]
mov dword [0x8177d8], eax
mov eax, dword [esi + 0x1f4]
test eax, eax
je 0x4034fb
push 0x7f
push eax
push 0x8177dc
call fcn.00402520
mov edx, dword [0x8177d4]
add esp, 0xc
jmp 0x403503
xor eax, eax
mov word [0x8177dc], ax
movzx eax, byte [esi + 0xaf]
mov ecx, 0xff
mov word [0x8178dc], ax
movzx eax, word [esi + 0xae]
and ax, cx
mov word [0x8178de], ax
movzx eax, word [0x7ffe02d0]
mov word [0x8178e0], ax
mov ecx, eax
mov byte [0x8178e2], 0
cmp byte [0x7ffe0268], 0
je 0x40354a
mov ebx, dword [0x7ffe0264]
pop esi
mov byte [0x8178e2], bl
cmp ebx, 1
pop ebx
jne 0x403564
and ecx, 0xffef
mov word [0x8178e0], cx
test edx, edx
jne 0x403599
call fcn.00403470
cmp dword [0x8177cc], 6
ja 0x403599
jb 0x403581
cmp dword [0x8177d0], 4
jae 0x403599
call fcn.00403470
cmp dword [0x8177cc], 0xa
jae 0x403599
mov dword [0x8177d4], 1
ret
Function at 0x403a30
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x108
push ebp
mov ebp, dword [esp + 0x110]
lea eax, [esp + 0xc]
push esi
push edi
push 0x100
push 0
lea esi, [ebp + 4]
push eax
mov dword [esp + 0x1c], esi
call fcn.004018d0
add esp, 0xc
xor edi, edi
test esi, esi
je 0x403b1e
test ebp, ebp
je 0x403b1e
push ebx
mov ebx, dword [esp + 0x124]
test ebx, ebx
je 0x403b1d
xor eax, eax
nop
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jb 0x403a80
xor esi, esi
mov edi, edi
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 3
movzx ecx, dl
movzx eax, byte [eax + ebp]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jb 0x403a90
mov esi, dword [esp + 0x120]
xor edi, edi
mov dword [esp + 0x10], edi
add esi, 0xfffffffc
je 0x403b1d
mov ebp, dword [esp + 0x14]
sub ebp, ebx
lea eax, [edi + 1]
movzx edi, al
lea ebx, [ebx + 1]
mov eax, dword [esp + 0x10]
mov cl, byte [esp + edi + 0x18]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [esp + 0x10], eax
movzx eax, byte [esp + eax + 0x18]
mov byte [esp + edi + 0x18], al
mov eax, dword [esp + 0x10]
mov byte [esp + eax + 0x18], cl
movzx eax, byte [esp + edi + 0x18]
add eax, edx
movzx eax, al
movzx eax, byte [esp + eax + 0x18]
xor al, byte [ebx + ebp - 1]
mov byte [ebx - 1], al
sub esi, 1
jne 0x403ad4
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x108
ret

Function at 0x403b30
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x18]
xor ecx, ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov edx, dword [eax + 0x3c]
movzx eax, word [eax + 0x38]
shr eax, 1
lea eax, [edx + eax*2]
cmp eax, edx
jb 0x403b67
mov edi, edi
cmp word [eax], 0x5c
je 0x403b5e
sub eax, 2
inc ecx
cmp eax, edx
jae 0x403b50
cmp ecx, 0xb
jae 0x403c33
push ebx
push esi
mov esi, 0xfffffffd
mov edi, edi
mov bl, 1
xor edx, edx
movzx ecx, bl
inc bl
movzx eax, byte [ecx + 0x8179f0]
add byte [edx + 0x8178f0], al
mov cl, byte [ecx + 0x8178f0]
add byte [edx + 0x8178f0], cl
inc edx
cmp edx, 0x100
jb 0x403b74
mov bl, 1
xor edx, edx
nop
movzx ecx, bl
inc bl
movzx eax, byte [ecx + 0x8179f0]
xor byte [edx + 0x8178f0], al
mov cl, byte [ecx + 0x8178f0]
xor byte [edx + 0x8178f0], cl
inc edx
cmp edx, 0x100
jb 0x403ba0
mov bl, 1
xor edx, edx
jmp 0x403bd0
movzx ecx, bl
inc bl
movzx eax, byte [ecx + 0x8179f0]
sub byte [edx + 0x8178f0], al
movzx eax, byte [edx + 0x8178f0]
sub al, byte [ecx + 0x8178f0]
mov byte [edx + 0x8178f0], al
inc edx
cmp edx, 0x100
jb 0x403bd0
mov bl, 1
xor eax, eax
movzx edx, bl
inc bl
movzx ecx, byte [edx + 0x8179f0]
xor byte [eax + 0x8178f0], cl
mov dl, byte [edx + 0x8178f0]
xor byte [eax + 0x8178f0], dl
inc eax
cmp eax, 0x100
jb 0x403c02
sub esi, 1
jne 0x403b70
pop esi
pop ebx
ret
Function at 0x403c40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, 0x2000000
mov bl, 1
xor edx, edx
jmp 0x403c50
movzx ecx, bl
inc bl
movzx eax, byte [ecx + 0x8179f0]
add byte [edx + 0x8178f0], al
mov cl, byte [ecx + 0x8178f0]
add byte [edx + 0x8178f0], cl
inc edx
cmp edx, 0x100
jb 0x403c50
mov bl, 1
xor edx, edx
jmp 0x403c80
movzx ecx, bl
inc bl
movzx eax, byte [ecx + 0x8179f0]
xor byte [edx + 0x8178f0], al
mov cl, byte [ecx + 0x8178f0]
xor byte [edx + 0x8178f0], cl
inc edx
cmp edx, 0x100
jb 0x403c80
mov bl, 1
xor edx, edx
jmp 0x403cb0
movzx ecx, bl
inc bl
movzx eax, byte [ecx + 0x8179f0]
sub byte [edx + 0x8178f0], al
movzx eax, byte [edx + 0x8178f0]
sub al, byte [ecx + 0x8178f0]
mov byte [edx + 0x8178f0], al
inc edx
cmp edx, 0x100
jb 0x403cb0
mov bl, 1
xor eax, eax
movzx edx, bl
inc bl
movzx ecx, byte [edx + 0x8179f0]
xor byte [eax + 0x8178f0], cl
mov dl, byte [edx + 0x8178f0]
xor byte [eax + 0x8178f0], dl
inc eax
cmp eax, 0x100
jb 0x403ce2
sub esi, 1
jne 0x403c47
pop esi
pop ebx
ret

Function at 0x4194e2
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret
Function at 0x416153
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x416192
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x416192
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x416192
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x416192
cmp dword [ecx + 0x74], 0xe
jbe 0x416192
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x428560
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42858d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42858d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0xa18058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa181a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa1807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa1806a
add dl, dl
jne 0xa18089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa180dc
xor eax, eax
add dl, dl
jne 0xa18096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa1817d
add dl, dl
jne 0xa180a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa180b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa180bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa180c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa180d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa18075
mov eax, 1
add dl, dl
jne 0xa180ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa180f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa180e1
sub eax, ebx
mov ebx, 1
jne 0xa18128
mov ecx, 1
add dl, dl
jne 0xa1810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa18119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa18105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa18075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa1813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa1814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa18136
cmp eax, 0x7d00
jae 0xa1816d
cmp eax, 0x500
jb 0xa18168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa18075
cmp eax, 0x7f
ja 0xa18170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa18075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa1819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa18075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x5edd70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x100000]
push edi
jmp 0x5edd8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5edd91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5edd80
mov eax, 1
add ebx, ebx
jne 0x5edda3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5eddb4
jne 0x5eddd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5eddd3
dec eax
add ebx, ebx
jne 0x5eddc0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5edd98
add ebx, ebx
jne 0x5eddcf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5ede25
xor ecx, ecx
sub eax, 3
jb 0x5eddeb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5ede5a
sar eax, 1
mov ebp, eax
jmp 0x5eddf6
add ebx, ebx
jne 0x5eddf6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5eddc4
inc ecx
add ebx, ebx
jne 0x5ede04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5eddc4
add ebx, ebx
jne 0x5ede11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5ede06
jne 0x5ede22
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5ede06
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5ede44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5ede36
jmp 0x5edd86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5ede44
add edi, ecx
jmp 0x5edd86
pop esi
mov edi, esi
mov ecx, 0x2f0f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5ede62
cmp byte [edi], 0x1e
jne 0x5ede62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5ede67
lea edi, [esi + 0x1ea000]
mov eax, dword [edi]
or eax, eax
je 0x5ededf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1ef35c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1ef488]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5ede94
mov ecx, edi
jns 0x5edec3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1ef48c]
or eax, eax
je 0x5eded9
mov dword [ebx], eax
add ebx, 4
jmp 0x5edeb1
call dword [esi + 0x1ef49c]
mov ebp, dword [esi + 0x1ef490]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5edf13
sub esp, 0xffffff80
jmp 0x463082
Function at 0x4219a3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x4219b2
pop dword [ebp - 0x24]
mov eax, 0xe72bd94b
add eax, 0x19164067
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x3e8e9
push 0
mov eax, 0x8a2e83e4
sub eax, 0x89ec31cc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x3fbfcedf
add ecx, 0xc0407b49
xor edx, edx
add edx, eax
mov esi, 0x2d713979
add esi, 0xd2d21a87
add esi, dword [ebp - 0x24]
mov ebx, 0xb6ada6e1
add ebx, 0x2555436
xor dword [ebp - 0xc], edi
mov edi, dword [esi]
xor dword [ebp - 0x20], eax
xor edi, ebx
xor dword [ebp - 8], ecx
mov dword [edx], edi
sub dword [ebp - 0x1c], edx
add edx, 0xa398066d
add edx, 0x5c67f997
add esi, 0xc3747450
add esi, 0x3c8b8bb4
loop 0x421a13
add eax, 0x11b73
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x40221e
Capabilities:
Access the windows event log
Clear file content
Clear windows event logs
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x800
push esi
push edi
xor esi, esi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, 0x58ce99d
jg 0x402242
inc edi
cmp edi, 0x1f6502b0
jl 0x40222a
cmp dword [0x432e1c], 0x400
jne 0x40229b
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push 0x420a98
push esi
call dword [sym.imp.ADVAPI32.dll_BackupEventLogW]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogW]
push str.digehogacisicaxafoxanet
push esi
call fcn.004025de
push esi
push esi
call fcn.00402734
push esi
call fcn.004027e1
push esi
call fcn.004027f0
add esp, 0x18
xor edi, edi
cmp edi, 0xd0fe
jge 0x4022ac
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 0x58bc6e
jg 0x4022cb
inc edi
cmp edi, 0xe52f
jl 0x40229d
mov eax, dword [0x422eb4]
mov dword [0x432e1c], eax
call fcn.00402004
mov edi, 0x3078f
cmp dword [0x432e1c], 0x51f
jne 0x4022f7
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec edi
jne 0x4022df
pop edi
xor eax, eax
pop esi
add esp, 0x800
ret 0x10

Function at 0x40614e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422b90]
jne 0x406158
repz ret
jmp fcn.00407ac3
Function at 0x40768e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x422b90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403a46
and dword [ebp - 0x14], 0
cmp dword [0x42d9dc], 0
mov dword [ebp - 0x18], eax
jne 0x407741
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4077e9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4077e9
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42d9dc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42d9e0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42d9e4], eax
call edi
push eax
call esi
mov dword [0x42d9ec], eax
test eax, eax
je 0x407741
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42d9e8], eax
mov eax, dword [0x42d9e8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40779a
cmp dword [0x42d9ec], ecx
je 0x40779a
push eax
call esi
push dword [0x42d9ec]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40779a
test ebx, ebx
je 0x40779a
call edi
test eax, eax
je 0x407791
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x407791
test byte [ebp - 8], 1
jne 0x40779a
or dword [ebp + 0x10], 0x200000
jmp 0x4077cd
mov eax, dword [0x42d9e0]
cmp eax, dword [ebp - 0x18]
je 0x4077cd
push eax
call esi
test eax, eax
je 0x4077cd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4077cd
mov eax, dword [0x42d9e4]
cmp eax, dword [ebp - 0x18]
je 0x4077cd
push eax
call esi
test eax, eax
je 0x4077cd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42d9dc]
call esi
test eax, eax
je 0x4077e9
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4077eb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040614e
leave
ret
Function at 0xac3058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00ac31a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xac307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xac306a
add dl, dl
jne 0xac3089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xac30dc
xor eax, eax
add dl, dl
jne 0xac3096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xac317d
add dl, dl
jne 0xac30a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xac30b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xac30bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xac30c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xac30d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xac3075
mov eax, 1
add dl, dl
jne 0xac30ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xac30f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xac30e1
sub eax, ebx
mov ebx, 1
jne 0xac3128
mov ecx, 1
add dl, dl
jne 0xac310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xac3119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xac3105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xac3075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xac313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xac314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xac3136
cmp eax, 0x7d00
jae 0xac316d
cmp eax, 0x500
jb 0xac3168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xac3075
cmp eax, 0x7f
ja 0xac3170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xac3075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xac319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xac3075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10011680
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x100116be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x100116b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x100116c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x100116a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10011790
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x100117c1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100117c1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x100117c1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1001b357
Capabilities:
Encode data using xor

Disassembly:
call 0x1001b2d0
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x1001b300
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x1001b31c
xor edx, 0
jmp 0x1001b327
xor edx, edx
jmp 0x1001b33e
jmp 0x1001b34a
xor eax, eax
push 0x8427d7c0
call 0x1001b357
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x1001b393
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x1001b36c
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x1001b3aa
add eax, 0
jno 0x1001b3af
add esi, 0
ret 0x10