joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ff7b
Capabilities:
Encode data using xor

Disassembly:
popfd
lea esp, [esp + 4]
ret
jmp 0x45f57f
mov dword [esp + 0x28], eax
jmp 0x45f61b
mov dword [esp + 0x28], eax
popal
jmp 0x45f52e
pop eax
sub eax, 0x4665aa96
jmp 0x45f58c
call 0x45f59c
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
or dword [edx - 0x33], edx
pop esp
scasd eax, dword es:[edi]
mov dh, 0x74
cld
jne 0x45f556
call dword [eax + 0x4663ad8a]
jmp 0x45f5b3
call 0x45f5c4
pop edi
pop edi
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
outsb dx, byte [esi]
js 0x45f62b
je 0x45f5c4
jmp 0x45f613
lea esp, [esp + 4]
jmp 0x45f5fb
call 0x45f5f6
mov ecx, dword [esp]
jmp 0x45f5db
sub ecx, 0x10018b9a
jmp 0x45f631
mov dword [esp + 0x28], eax
jmp 0x45f770
push eax
call fcn.0044ab40
jmp 0x45f5f1
popal
jmp 0x45f842
call 0x45f626
jmp 0x45f904
invalid
mov dword [ecx + reloc.USER32.dll_CreateWindowExW], eax
jmp 0x45f7c5
call 0x45f723
push eax
push ebx
inc ecx
push eax
dec ecx
inc esp
dec esp
dec esp
add cl, ch
clc
add dword [eax], eax
add byte [edi + 0x103840f], bl
add byte [eax], al
je 0x45f832
jne 0x45f54c
mov dword [ecx + reloc.USER32.dll_CreateWindowExW], eax
jmp 0x45f848
popal
push ebp
lea esp, [esp + 1]
lea esp, [esp + 3]
push edx
jmp 0x45f7ad
lea edx, [esp + eax]
mov dx, word [esp]
push ecx
mov edx, 0x530e75c5
jmp 0x45f797
mov dx, 0xf62e
mov dx, 0xfed6
xchg ecx, edx
mov edx, esi
jmp 0x45f7ef
mov edx, 0xc8d2cd32
mov dl, byte [esp]
mov edx, dword [esp]
mov dx, di
mov dh, 0xe2
jmp 0x45f77d
movzx ebx, byte [eax]
add ebx, 0x44fafb0c
cmp ebx, 0x44fafbd8
jmp 0x45f729
lea esi, [ebx + edi]
mov cx, dx
mov dh, byte [esp]
pop esi
mov cl, byte [esp]
call fcn.0045f81e
out dx, eax
mul cl
and byte [ebp + 0xb50c], cl
add byte [eax], al
lea ecx, [esi*4]
lea edx, [edx*4]
push esi
not edx
mov ecx, dword [esp]
mov dx, bx
jmp 0x45f7d9
xchg ecx, edx
mov ecx, dword [esp + 8]
jmp 0x45f8d1
popfd
lea esp, [esp + 4]
ret
movzx ebx, byte [eax]
jmp 0x45f87a
add ebx, 0x51320eca
cmp ebx, 0x51320f96
je 0x45f8e4
jne 0x45f603
call 0x45f893
jmp 0x45fe8d
jmp 0x45fc01
mov dl, byte [esp]
not dx
mov dx, 0x7cb5
lea edx, [ecx + edi]
call fcn.0045f89d
jne 0x45f8b3
into
je 0x45f91a
mov dword [esp + 0x24], eax
jmp 0x45fecf
pop eax
sub eax, 0xd4b533af
jmp 0x45f714
pushal
jmp 0x45f621
inc dword [esp + 8]
popfd
ret 4
pop eax
sub eax, 0x5ba4bf4f
jmp 0x45ff6b
popal
popfd
ret
call 0x45ff7b
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add bh, bh
nop
cli
mov esi, 0x4fe95ba2
std
invalid
Function at 0x50109e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, 0x13d25965
xchg word [esp + 8], cx
pop word [esp + 0xc]
jmp 0x501085
add esp, 0
cpuid
mov dh, 0xaf
cmc
sub esp, 0x16
mov byte [esp + 0x10], cl
jmp 0x50105e
xchg byte [esp + 7], ch
not di
add esp, 0x10
shl dl, 1
mov ecx, esp
xchg cx, bx
jmp 0x5010e7
rdtsc
mov ecx, dword [esp]
mov dword [esp], ecx
add esp, 3
jmp 0x501074
mov bx, 0x3848
bsr edi, ebp
rdtsc
lea esp, [esp + 3]
jmp 0x501101
xchg dx, bp
btr cx, sp
lea ecx, reloc.USER32.dll_CreateWindowExW
bswap edx
push si
cmc
jmp 0x5010ab
push word [esp + 2]
rcl edi, 0xd
mov dword [esp], edx
xchg cx, bx
mov edx, 0x1cad6dff
xchg word [esp + 2], bx
jmp 0x5010c1
lea ebp, [esi - 0xe8]
mov edx, dword [esp + 5]
bts eax, eax
neg edx
shr bp, cl
cmc
jmp 0x50118d
pop bp
mov esi, 0x95610a4d
not al
xchg cx, bx
xchg si, bx
lea eax, reloc.USER32.dll_CreateWindowExW
jmp 0x501130
push dword [esp + 4]
xchg dword [esp], eax
mov edi, dword [esp + 9]
not eax
dec ah
pop ebx
jmp 0x50114d

Function at 0x501443
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0xe], bx
jmp 0x5014a5
rol bl, cl
push dword [esp + 0xd]
clc
bswap edx
btc ax, bx
inc cl
jmp 0x5015c3
mov ecx, dword [esp + 2]
mov ecx, dword [esp + 0xd]
cpuid
mov dword [esp + 4], eax
stc
mov edi, eax
jmp 0x50148f
push word [esp + 3]
xchg dword [esp + 3], ebx
pop ebp
rdtsc
pop dword [esp]
mov bp, 0x6beb
jmp 0x501507
xchg word [esp + 3], bx
pushal
stc
lea edi, reloc.USER32.dll_CreateWindowExW
sub eax, esi
lea esp, [esp + 0x31]
jmp 0x501520

Function at 0x5021d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg bl, dh
push word [esp + 0xb]
sub esp, 0x11
xchg word [esp + 0x1b], bp
xchg esi, edx
jmp 0x5021ea
cld
jmp 0x5021b8
mov bx, cx
clc
xchg ebp, edi
pop word [esp + 0xc]
not cx
jmp 0x502236
mov bl, byte [esp + 0x14]
mov bh, 0x60
rdtsc
add esp, 0
xchg word [esp + 0xf], di
mov ax, 0x89f0
jmp 0x5021d4
lea ebp, [ecx*4]
mov al, 0x5c
mov ebx, dword [esp + 8]
xchg bl, ah
jmp 0x502249
mov dword [esp + 0x11], edx
sub esp, 0xe
add esp, 0x18
lea ecx, [eax + edx]
cld
sub esp, 5
jmp 0x502220
btr edx, ebx
bts eax, esp
rdtsc
mov ecx, dword [esp + 0x13]
lea esp, [esp + 2]
lea esp, [esp + 0x18]
jmp 0x502521
popal
sub esp, 0xd
mov byte [esp + 9], al
pop word [esp + 6]
call fcn.005023f1
Function at 0x5038f8
Capabilities:
Execute anti-debugging instructions

Disassembly:
not edx
rol esi, 8
mov bl, 0x68
not ax
rcr ch, cl
jmp 0x503941
xchg bp, ax
std
jmp 0x5038e2
popal
bswap ebp
rdtsc
mov ebp, dword [esp + 9]
pop eax
push dword [esp + 5]
jmp 0x503979
lea ebx, reloc.USER32.dll_CreateWindowExW
mov esi, 0x2abf3cee
setns bl
push word [esp + 0x16]
cld
mov di, 0x8bd
jmp 0x50392a
clc
pop bp
pop di
mov cx, 0x1ea0
std
xchg byte [esp], al
jmp 0x5039a4
lea ecx, [esi + ebp]
rcr bh, cl
cmc
pop word [esp + 2]
mov cx, word [esp + 1]
or bl, 0x6a
jmp 0x50395b
add esp, 1
mov word [esp], dx
cpuid
shr bl, 4
pop ax
jmp 0x5039f6
sub esp, 2
neg ch
rdtsc
push word [esp]
pop dword [esp]
mov bh, ah
jmp 0x50398e
mov word [esp + 0x17], bx
mov di, 0xa0e1
neg bx
mov ecx, dword [esp + 0x12]
jmp 0x503a22
mov ecx, 0x1fba67c6
pushal
push word [esp + 4]
mov word [esp + 0x16], bx
lea esi, [esi + esi]
inc esi
jmp 0x5039e0
xchg dh, cl
mov dword [esp], esp
setg bh
mov byte [esp + 0x15], al
sbb cl, 0x36
jmp 0x503aae
mov esi, 0xe805b3cd
mov byte [esp + 0x10], bl
lea edi, [edi*4]
bt bp, dx
xchg cl, bh
xchg bl, ch
jmp 0x503a0c
xchg word [esp], si
mov dh, al
sub esp, 7
xchg dword [esp], ebx
not edx
jmp 0x503b3e
not ecx
mov dx, 0xccc5
stc
mov word [esp], ax
lea esi, reloc.USER32.dll_CreateWindowExW
push word [esp]
jmp 0x503a71
mov dx, 0x2622
popal
inc ebp
pop cx
xchg word [esp], bx
inc ecx
jmp 0x503a87
lea edx, [ecx*4]
sub esp, 3
mov dl, bl
call fcn.00503b1e
push ds
imul ecx, dword [eax - reloc.USER32.dll_CreateWindowExW], 0x824448a
mov ch, bh
mov al, byte [esp + 8]
std
std
lea ebx, [eax*4]
pop dword [esp + 4]
jmp 0x503abd
xchg word [esp + 5], bx
rcr dl, cl
mov word [esp + 0xa], sp
xchg word [esp + 0xc], bx
rol dh, 4
bswap edx
jmp 0x503ad3
lea ecx, reloc.USER32.dll_CreateWindowExW
xchg dword [esp + 2], ebx
rdtsc
mov byte [esp + 3], bl
push edi
lea ebx, [edx + edx]
jmp 0x503af0

Function at 0x503a61
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 1
mov dword [esp], ebx
pop word [esp]
sub esp, 0
jmp 0x503846
lea esp, [esp + 2]
pushal
bt ebp, edi
cld
xchg dx, cx
bswap ebx
jmp 0x5039c6
shl ch, cl
not ah
lea esi, [eax*4]
mov bp, word [esp + 2]
jmp 0x5038b8
cld
push word [esp]
mov dh, bl
rcl ah, 5
rdtsc
rcl dx, 4
jmp 0x50387a
mov esi, 0x105c5f2d
mov esi, 0xc11a7b92
pushal
xchg di, si
call fcn.005038f8
xchg ecx, eax
adc byte [ebx + 0x424748b], dl
mov esi, dword [esp + 4]
mov dword [esp], edi
xchg word [esp + 1], cx
rdtsc
xchg esi, ebx
jmp 0x5038a2
bsf bx, ax
xchg bp, si
setno dh
xchg ebp, eax
bswap ecx
bswap esi
jmp 0x503890
add esp, 7
xchg dword [esp], ebx
mov esi, 0x3197f0a1
xchg byte [esp + 2], ch
pop dx
bt cx, ax
jmp 0x5038d0
sub esp, 0x10
cpuid
mov esi, dword [esp + 8]
mov cl, 0x21
pop dword [esp + 6]
lea esi, reloc.USER32.dll_CreateWindowExW
jmp 0x503913
call 0x503a61
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
and byte [esi + 0x32], dh
xor al, 0x2e
xor byte [esi], ch
xor byte [eax], al
pushfd
sub esp, 0xd
add esp, 8
mov byte [esp + 2], dh
jmp 0x50382a
Function at 0x504164
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, 0xceac6b1d
mov eax, dword [esp + 5]
lea esp, [esp + 5]
add esp, 1
jmp 0x5040fa
cmp dl, 0x4d
xchg dx, bp
setl ah
xchg word [esp + 1], di
mov word [esp], sp
stc
jmp 0x5040b1
mov bh, byte [esp + 4]
inc bh
mov byte [esp + 2], ah
add esp, 1
mov bh, byte [esp + 6]
bswap esi
jmp 0x5040c7
sub esp, 0x1b
mov word [esp + 0x17], bx
dec cl
pop word [esp + 9]
bsf dx, dx
setnp bh
jmp 0x504142
push word [esp + 5]
xchg ah, bh
rcl dx, 2
mov bl, dh
mov dh, bh
mov bh, 0xc8
jmp 0x5040e5
lea ecx, [eax + ebp]
shl eax, cl
sub esp, 0x1b
xchg al, ah
cmc
mov di, 0x270a
jmp 0x5041e4
xchg si, bx
push dword [esp + 0xa]
dec al
pop dword [esp + 4]
mov ebp, dword [esp + 0xd]
xchg bh, cl
jmp 0x50412c
mov dl, byte [esp + 1]
jmp 0x504119
pushfd
rdtsc
lea edi, [edx*4]
xchg dword [esp], edi
jmp 0x504193
mov edi, dword [esp]
mov cl, 0x8e
bt bp, di
mov edx, edi
mov cx, 0x434
rdtsc
jmp 0x50416a
lea esp, [esp + 2]
mov esi, dword [esp]
mov bp, 0x3ce4
add esp, 0
btr ecx, ebx
jmp 0x5041be
mov cx, word [esp]
push ebp
pop di
mov word [esp], si
xchg ah, cl
xchg word [esp], si
jmp 0x504180
rcl ebp, cl
add esp, 0
mov edi, 0xdef1b510
xchg dword [esp], eax
add dh, bh
xchg dh, ch
jmp 0x50420e
mov byte [esp], al
cpuid
lea ebp, [eax + 0x7d]
mov ebx, 0x30042bd
pushal
lea esp, [esp + 0x55]
jmp 0x5041ab
xchg byte [esp + 7], ch
sub esp, 7
lea ecx, [ebp*4]
cmc
jmp 0x50424d
dec bl
sub esp, 7
mov dx, bx
mov dword [esp + 1], edx
mov byte [esp + 9], al
lea edi, [esp + esi]
jmp 0x5041f8
cmc
add esp, 0xf
dec ax
mov ebx, dword [esp + 3]
lea esp, [esp + 0x17]
setl cl
jmp 0x504265
xchg dword [esp + 1], ebp
clc
bsf cx, cx
push dword [esp + 7]
cld
jmp 0x50429f
pop word [esp + 0xc]
sub esp, 0x1b
xchg dword [esp + 0xb], ecx
dec di
push word [esp + 0xb]
add esp, 3
jmp 0x504223
setne dl
xchg dword [esp], edx
cmc
mov dx, si
bsf cx, sp
pushfd
jmp 0x504236
push word [esp + 3]
lea ebp, [eax + esi]
dec ch
pop eax
xchg dword [esp + 1], edx
xchg byte [esp + 4], cl
jmp 0x504289

Function at 0x5046e7
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov word [esp + 5], di
lea esi, [esp + eax]
mov esi, dword [esp + 8]
jmp 0x50472a
bswap eax
mov byte [esp + 2], al
sbb ah, bh
jmp 0x5046d1
lea eax, [ecx*4]
lea eax, [eax*4]
mov ax, word [esp + 6]
lea ecx, [eax + ecx]
lea ebx, [ecx + esi]
cpuid
jmp 0x504714

Function at 0x50498d
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], edi
lea esp, [esp + 8]
jmp 0x504942
Function at 0x1074d210
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1074d360
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1074d236
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1074d222
add dl, dl
jne 0x1074d241
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1074d294
xor eax, eax
add dl, dl
jne 0x1074d24e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1074d335
add dl, dl
jne 0x1074d25d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1074d268
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1074d273
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1074d27e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1074d28a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1074d22d
mov eax, 1
add dl, dl
jne 0x1074d2a2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1074d2ad
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1074d299
sub eax, ebx
mov ebx, 1
jne 0x1074d2e0
mov ecx, 1
add dl, dl
jne 0x1074d2c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1074d2d1
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1074d2bd
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1074d22d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1074d2f7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1074d302
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1074d2ee
cmp eax, 0x7d00
jae 0x1074d325
cmp eax, 0x500
jb 0x1074d320
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1074d22d
cmp eax, 0x7f
ja 0x1074d328
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1074d22d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1074d356
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1074d22d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x418010
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xb0
mov al, byte [0x4c4048]
mov cl, byte [0x4c4047]
xor cl, al
push esi
mov byte [0x4c4047], cl
mov cl, byte [0x4c4042]
or cl, 8
mov esi, dword [esp + 0xb8]
shr cl, 3
and ecx, 0xff
push 5
mov dword [esp + 8], ecx
fild dword [esp + 8]
fdivr qword [0x4c79c0]
fadd qword [0x4c4050]
fstp qword [0x4c79b0]
mov dword [esi], 0
call dword [sym.imp.USER32.dll_GetSysColor]
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x41807e
or dword [esi], 0x4000000
mov al, byte [0x4c4045]
mov dl, byte [0x4c4044]
xor al, dl
mov byte [0x4c4045], al
or al, 0x30
shr al, 4
and eax, 0xff
mov dword [esp + 4], eax
fild dword [esp + 4]
fdivr qword [0x4c7a20]
fstp qword [0x4c79b0]
fld qword [0x4c4050]
fadd qword [0x4c79c0]
fstp qword [0x4c79c0]
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov eax, esi
pop esi
add esp, 0xb0
ret

Function at 0x4bc63d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c43c0
cmp edx, dword [eax]
je 0x4bc65f
add eax, 8
inc ecx
cmp eax, 0x4c4450
jl 0x4bc650
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c43c0]
jne 0x4bc78d
mov eax, dword [0x4c9d54]
cmp eax, 1
je 0x4bc767
test eax, eax
jne 0x4bc690
cmp dword [0x4c42e8], 1
je 0x4bc767
cmp edx, 0xfc
je 0x4bc78d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bc6c7
lea eax, [ebp - 0x1a4]
push 0x4c19a8
push eax
call fcn.004bd020
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bd4b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bc70a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bd4b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c19a4
push edi
call fcn.004bf380
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c1988
push eax
call fcn.004bd020
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bd030
lea eax, [ebp - 0xa0]
push 0x4c1984
push eax
call fcn.004bd030
push dword [esi + 0x4c43c4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bd030
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c195c
push eax
call fcn.004bf2f4
add esp, 0x2c
pop edi
jmp 0x4bc78d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c43c4]
push 0
push eax
push dword [esi]
call fcn.004bd4b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401690
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40b07c]
jne 0x40169a
repz ret
jmp fcn.00401e09

Function at 0x4042fc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40b07c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004031a4
and dword [ebp - 0x14], 0
cmp dword [0x40c8a8], 0
mov dword [ebp - 0x18], eax
jne 0x4043af
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404457
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404457
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40c8a8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40c8ac], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40c8b0], eax
call edi
push eax
call esi
mov dword [0x40c8b8], eax
test eax, eax
je 0x4043af
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40c8b4], eax
mov eax, dword [0x40c8b4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404408
cmp dword [0x40c8b8], ecx
je 0x404408
push eax
call esi
push dword [0x40c8b8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404408
test ebx, ebx
je 0x404408
call edi
test eax, eax
je 0x4043ff
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4043ff
test byte [ebp - 8], 1
jne 0x404408
or dword [ebp + 0x10], 0x200000
jmp 0x40443b
mov eax, dword [0x40c8ac]
cmp eax, dword [ebp - 0x18]
je 0x40443b
push eax
call esi
test eax, eax
je 0x40443b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40443b
mov eax, dword [0x40c8b0]
cmp eax, dword [ebp - 0x18]
je 0x40443b
push eax
call esi
test eax, eax
je 0x40443b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40c8a8]
call esi
test eax, eax
je 0x404457
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404459
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401690
leave
ret
Function at 0x406360
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push esi
mov edx, 0xc6ef3720
mov dword [ebp - 4], 0x20
push edi
lea ebx, [ebx]
mov esi, ecx
shr esi, 5
add esi, dword [0x40a084]
mov edi, ecx
shl edi, 4
add edi, dword [0x40a080]
xor esi, edi
lea edi, [edx + ecx]
xor esi, edi
sub eax, esi
mov esi, eax
shr esi, 5
add esi, dword [0x40a07c]
mov edi, eax
shl edi, 4
add edi, dword [0x40a078]
xor esi, edi
lea edi, [edx + eax]
xor esi, edi
sub ecx, esi
add edx, 0x61c88647
dec dword [ebp - 4]
jne 0x406380
mov edx, dword [ebp + 8]
pop edi
mov dword [edx], ecx
mov dword [edx + 4], eax
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x406410
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0x404a0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.GlobalAlloc
push eax
mov dword [0x40ccf0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x404a0
push 0
mov dword [0x40ccec], eax
call eax
mov dword [0x40cce8], eax
xor eax, eax
cmp dword [ebp - 4], eax
jbe 0x40646f
mov cl, byte [eax + 0x414090]
mov edx, dword [0x40cce8]
mov byte [edx + eax], cl
inc eax
cmp eax, dword [ebp - 4]
jb 0x40645a
lea eax, [ebp - 4]
call fcn.004063e0
mov ecx, dword [0x40cce8]
lea eax, [ebp - 8]
push eax
push 0x40
push 0x404a0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
call dword [0x40cce8]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4065c0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.dfgdfgdfg.exe
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x406668
call fcn.004064b0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.MSIMG32.dll_TransparentBlt]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.MSIMG32.dll_GradientFill]
mov eax, dword [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.MSIMG32.dll_AlphaBlend]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push 0
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetDiskFreeSpaceExW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExA]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
call fcn.004064e0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x422c55e8
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x6c6e6ffa
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp int.00401219
Function at 0x671370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x67138e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x69a074
push ecx
mov edi, eax
call fcn.00685198
mov esi, eax
add esp, 8
test esi, esi
jne 0x6713cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0068502e
push esi
call fcn.00684fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret