joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c04
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x10020a8
call fcn.01001dd4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1003abc
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x10019bb
cmp eax, esi
jne 0x10019ae
xor esi, esi
inc esi
mov ebx, esi
jmp 0x10019be
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001995
xor esi, esi
inc esi
mov eax, dword [0x1003ab8]
cmp eax, esi
jne 0x10019d1
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1001a00
mov eax, dword [0x1003ab8]
test eax, eax
jne 0x10019fa
mov dword [0x1003ab8], esi
push 0x1001114
push 0x1001108
call fcn.010018fa
pop ecx
pop ecx
test eax, eax
je 0x1001a00
jmp 0x1001b28
mov dword [0x100310c], esi
mov eax, dword [0x1003ab8]
cmp eax, esi
jne 0x1001a24
push 0x1001104
push 0x10010fc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1003ab8], 2
test ebx, ebx
jne 0x1001a30
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1003ac0], 0
je 0x1001a54
push 0x1003ac0
call fcn.01001d49
pop ecx
test eax, eax
je 0x1001a54
push 0
push 2
push 0
call dword [0x1003ac0]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x1001ab0
test al, al
je 0x1001a6e
cmp dword [ebp - 0x1c], 0
jne 0x1001ab0
mov al, byte [esi]
test al, al
je 0x1001a7e
cmp al, 0x20
ja 0x1001a7e
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1001a6e
test byte [ebp - 0x3c], 1
je 0x1001a8a
movzx eax, word [ebp - 0x38]
jmp 0x1001a8d
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1003108], eax
cmp dword [0x10030fc], 0
jne 0x1001b04
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x1001abf
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x1001ad2
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x1001a5b
cmp dword [0x100310c], 0
jne 0x1001b13
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1003108]
jmp 0x1001b34
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01001e19
ret
call fcn.01001f21
jmp 0x100195b
Function at 0x680b12
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp dword [esi - 0x77]
mov word [esp + 5], ax
call fcn.00680b2e
jno 0x680afb
arpl word [esi], ax
cmc
jbe 0x680b6f
mov al, byte [0x53751ae3]
push ebx
pop word [esp + 2]
mov byte [esp + 4], dl
push word [esp + 4]
jmp 0x680b44
jns 0x680afc
mov word [esp + 5], ax
jmp 0x680b01
jmp 0x680c31
not ebx
lea eax, [eax - 0xd4]
clc
jae 0x680bb7
jb 0x680bb7
xor esi, dword [edi + reloc.KERNEL32.dll_GetDriveTypeA]
sub al, byte [ebp - 0xc]
xchg bx, ax
bswap ecx
lea eax, [ebp + ebp]
xchg bx, ax
jmp 0x680bf6
lea edi, [esp]
jmp 0x680ba1
bsr bx, bp
mov eax, esi
mov dl, bl
jmp 0x680bdd
bsf eax, edx
js 0x680bbc
bsr bx, bp
jmp 0x680bc0
neg bx
jp 0x680c06
mov ecx, dword [esp]
mov dx, 0x3ce4
mov cx, word [esp]
mov edx, dword [esp]
jmp 0x680c5a
sub esp, 0xc0
mov ebp, esp
mov bx, 0x1fb1
xchg ah, dl
jmp 0x680bd2
mov ecx, dword [esp]
mov dx, 0x3ce4
jmp 0x680c14
mov cx, word [esp]
mov edx, dword [esp]
mov edx, dword [esp]
lea ecx, [esi*4]
btc ebx, edx
jmp 0x680ca3
mov esi, dword [esp]
mov ebp, ebx
rdtsc
mov esi, dword [esp + 0x2c]
lea ebx, [esi + 0x26]
jmp 0x680b74
mov edx, dword [esp]
call fcn.00680c44
salc
push edi
invalid
je 0x680cc1
jne 0x680cc1
mov ecx, dword [esp + 1]
xchg word [esp], dx
xchg byte [esp], ch
clc
ja 0x680ce2
jbe 0x680ce2
adc dword [edx + reloc.KERNEL32.dll_GetDriveTypeA], ebx
jnp 0x680d11
int 0x5c
rol esi, 0
mov edx, dword [esp]
pushfd
mov ecx, edi
jmp 0x680ca7
lea esp, [esp + 4]
neg esi
lea edx, [edx + edx]
sete ch
cmc
jmp 0x680d27
jmp 0x680ccc
and bh, ah
inc dx
btc edx, ebp
mov dx, 0xac62
bswap ecx
jmp 0x680d45
btc edx, ebp
mov dx, 0xac62
bswap ecx
jmp 0x680d45
xor ebp, dword [edi]
cmpsd dword [esi], dword es:[edi]
aaa
push edx
mov eax, dword [reloc.KERNEL32.dll_GetDriveTypeA]
sub eax, ebx
push ds
mov ebx, 0x3fcca535
clc
movsb byte es:[edi], byte [esi]
xlatb
jl 0x680ce4
jl 0x680ce4
and bh, ah
inc dx
jmp 0x680d07
sub cx, 0x2df4
bt ecx, ecx
bsr ebx, ebp
jmp 0x680da8
sub esi, 0x3559d79c
mov dx, di
sub esp, 0xc
jns 0x680d2f
js 0x680d5d
lea ebx, reloc.KERNEL32.dll_GetDriveTypeA
in al, dx
jmp dword [esi - 0x7f]
sub cx, 0x2df4
bt ecx, ecx
bsr ebx, ebp
jmp 0x680da8
lea esp, [esp + 0xc]
neg esi
mov cx, word [esp]
lea ebx, [ebx + edi]
call fcn.00680d92
setp dh
mov bh, 0xa7
lea esp, [esp + 4]
dec esi
lea edx, [esi + edi]
jmp 0x680e5e
add esi, dword [edi]
bsf dx, si
jl 0x680e0c
mov dh, byte [esp]
neg dx
xchg cl, ch
call fcn.006814b1
jp 0x680e00
bt ecx, esp
cmc
jmp 0x680dda
mov dword [reloc.KERNEL32.dll_GetDriveTypeA], eax
neg dx
xchg cl, ch
jmp fcn.00680e27
sub al, 0xdf
insd dword es:[edi], dx
rol dword [esi - 0x2c], cl
mov bl, 0x4e
invalid
mov dh, byte [esp]
jmp 0x680df6
cmc
jle 0x680df0
bt ecx, esp
cmc
jmp 0x680dda
Function at 0x6819e2
Capabilities:
Execute anti-debugging instructions

Disassembly:
add bl, al
pushfd
mov dl, 0xac
mov dx, 0x893a
jmp 0x68187d
jmp 0x6818cd
not dx
add dl, ah
rol cl, 0
jmp 0x6818b7
mov edx, dword [esp + 2]
mov cl, bl
lea edx, [esi*4]
neg edx
ja 0x68185c
mov dx, 0x46fd
mov dx, word [esp]
mov dh, bh
not dx
add dl, ah
jmp 0x681863
dec dl
jo 0x6818d9
cmc
clc
jmp 0x6818e1
mov dx, 0x46fd
mov dx, word [esp]
mov dh, bh
jmp 0x68185e
cmc
clc
jmp 0x6818e1
neg cl
lea edx, [ebx*4]
bswap edx
mov edx, eax
jmp 0x681926
call fcn.00681953
xchg word [esp + 3], dx
btc edx, ebx
jmp 0x68196f
mov edx, 0xde120163
inc cl
bt dx, sp
jle 0x681908
jg 0x681908
jns 0x68190d
xchg word [esp + 3], dx
btc edx, ebx
jmp 0x68196f
bsf dx, si
not edx
mov edx, esp
sete dh
jmp 0x6819ce
lea esp, [esp + 8]
not cl
bsr edx, edx
jns 0x681959
js 0x681984
aaa
mov bh, 0x27
inc edx
mov cl, 0xb
sub al, byte [ebp + 0x66]
bsf edx, esi
bsf dx, si
not edx
mov edx, esp
jmp 0x6819f8
neg cl
lea edx, [edi + ebp]
mov dl, ch
mov dx, 0x7088
mov edx, dword [esp]
call 0x6819e2
cmp al, 0xe9
xchg edx, eax
or dword [eax], eax
add byte [edi], al
xchg ebx, eax
add esp, dword [esi - 0x6b]
and eax, 0xed8a149f
sbb al, 0xdd
add eax, eax
cmp dword [edx], 0x15
sete dh
call fcn.006819b8
mov es, word [esi]
xchg esp, eax
push cs
retf

Function at 0x681e8b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 1], cx
mov ecx, 0xe7d0d8f4
xor ecx, 0xcd1d3217
jmp 0x681ea8
jge 0x681ebe
mov dx, 0x211c
jmp 0x681ec2
mov dx, 0x211c
inc bl
sets ch
jmp 0x681ef1
mov dx, 0x4e39
not edx
jmp 0x681f1d
not edx
lea edx, reloc.KERNEL32.dll_GetDriveTypeA
jmp 0x681f23
or dword [eax + reloc.KERNEL32.dll_GetDriveTypeA], ebp
mov cl, byte [esp]
bsf edx, edi
jl 0x681ec9
mov dx, 0x4e39
jmp 0x681ed5
pushal
lea ecx, [ebx*4]
call fcn.00681f88
jae 0x681eee
jbe 0x681f21
loopne 0x681f69
invalid
lea edx, reloc.KERNEL32.dll_GetDriveTypeA
invalid
xor bl, 0xe7
bswap edx
shr cx, cl
jmp 0x681f31
jbe 0x681eff
pushal
lea ecx, [ebx*4]
jmp 0x681f07
jb 0x681fd8
jl 0x681fbc
salc
sal dword [edx + reloc.KERNEL32.dll_GetDriveTypeA], 1
and dl, dl
salc
nop
cld
Function at 0x681f88
Capabilities:
Execute anti-debugging instructions

Disassembly:
add ecx, 0xc333e02a
call fcn.0068203c
fistp word [edi - 0x31]
stosb byte es:[edi], al
pop ecx
sal dword [edx], cl
sub eax, 0xf7660f3c
neg dx
jo 0x67efdd
and eax, 0x59cc62d4
leave
test al, 0x5b
popfd
cmp byte [ebx], bl
mov ch, 0x1a
call fcn.00681e8b
mov dx, 0xbe32
not ecx
mov dl, 0x40
mov dx, 0x9863
mov ecx, dword [esp]
jmp 0x681f8a
lea esp, [esp + 0x24]
inc bl
not edx
dec dl
jl 0x681f58
jge 0x681fb7
push edi
rcl dword [ecx + 0x30], 0xc3
jno 0x681f46
jp 0x681fda
les esi, [edi + 0x5e]
jmp 0x681f6e
rol bl, 0
not cx
lea ecx, [eax*4]
mov ch, bh
jmp 0x68205e
mov dx, 0x9863
mov ecx, dword [esp]
jmp 0x681f8a
mov dx, 0xbe32
not ecx
mov dl, 0x40
jmp 0x681fa0
jnp 0x681fe3
rcl dh, cl
mov edx, edi
jmp 0x681fe7
mov ecx, ebx
bsf edx, edx
jne 0x682028
cmc
jmp 0x681fff
cli
popfd
insb byte es:[edi], dx
ficom dword [ecx]
nop
adc ecx, dword [edx - reloc.KERNEL32.dll_GetDriveTypeA]
rcl dh, cl
mov edx, edi
jmp 0x681fc9
neg dx
jp 0x682008
jnp 0x67efdf
movsd dword es:[edi], dword ds:[esi]
xor eax, 0x5469af5c
invalid
lea edx, [esp + 0x2d]
and dx, dx
jmp 0x682030
jmp 0x67efdf
cmc
lea edx, [esp + 0x2d]
and dx, dx
shl ecx, 2
lea edx, [edi*4]
jmp 0x681fe9
mov dl, byte [esp]
mov dl, bl
sub bl, 2
lea edx, [edi - 0xd]
inc dh
jmp 0x681fc1

Function at 0x78cd90
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esi, [ebp + 0xf8]
call 0x78cd90
and esi, ebp
add esp, 0x23
xchg byte [esp + 1], cl
mov ebp, 0xa41fe533
jmp 0x78cdcd
mov cl, ah
mov bx, word [esp + 6]
setae bl
mov cx, word [esp + 9]
pop ebx
jmp 0x78cddf
lea esp, [esp + 0xf]
cmc
setl bl
mov al, bh
push dword [esp + 1]
rdtsc
jmp 0x78cdb7
mov byte [esp + 3], dh
bswap eax
not eax
add esp, 5
adc ecx, ebp
lea ecx, [ecx + edi]
jmp 0x78ce2b
rdtsc
pop di
lea eax, reloc.KERNEL32.dll_GetDriveTypeA
xchg bx, bp
rcr si, cl
jmp 0x78ce5c
lea eax, reloc.KERNEL32.dll_GetDriveTypeA
and bx, 0xcf4b
mov dx, word [esp + 1]
neg dh
lea esp, [esp]
lea eax, [ebx + edi]
jmp 0x78ce15
bsf edx, edi
xchg ch, ah
mov esi, dword [esp]
lea edx, [ecx*4]
jmp 0x78ce82
setge ch
setp dh
std
sets cl
bswap ebx
mov dh, al
jmp 0x78ce46
rol dx, 0xa
bts dx, bp
add esp, 0
neg ax
jmp 0x78ce94
sets ah
not bl
xchg byte [esp], dh
bsr dx, bp
cmc
mov al, byte [esp]
jmp 0x78ce6c
not dx
neg edi
mov bl, byte [esp]
lea esp, [esp]
lea ebx, [edx + ebp]
std
jmp 0x78cef4
mov dx, word [esp]
bt cx, bx
xor al, 0x2b
mov eax, ebx
mov bp, 0xe82c
mov ch, dh
jmp 0x78cf89
mov di, bx
xchg si, ax
lea esp, [esp]
mov ax, 0x951c
not bl
lea esp, [esp]
jmp 0x78ced2
mov bl, byte [esp]
neg bx
lea ebx, reloc.KERNEL32.dll_GetDriveTypeA
call fcn.0078cf3a

Function at 0x78d1b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 4], al
add edx, 0x31a2fc3a
btr si, si
sub di, di
jmp 0x78d1fb
pop word [esp + 5]
push di
lea esp, [esp + 0xb]
xchg bx, si
mov dl, ah
jmp 0x78d1e5
Function at 0x78dae3
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 2]
rdtsc
mov edx, 0x27e51e57
mov ah, byte [esp]
not cx
lea esp, [esp + 7]
lea ecx, reloc.KERNEL32.dll_GetDriveTypeA
xchg byte [esp], al
rdtsc
lea esp, [esp + 1]
neg si
jmp 0x78d948
mov ebx, ecx
xchg di, ax
btr di, si
mov ebx, dword [esp]
push dword [esp]
bsr si, bx
jmp 0x78d962
mov word [esp + 1], bx
bts ebp, eax
mov bl, byte [esp + 3]
lea edx, [esi*4]
mov di, 0x63b6
add esp, 1
jmp 0x78d99f
clc
pop word [esp + 1]
xchg dl, al
rdtsc
lea esi, [eax + esi]
bsf eax, esp
jmp 0x78d9ea
bsr eax, esp
rcl ebp, 0x19
mov word [esp + 2], dx
mov esi, dword [esp + 2]
btc edi, esp
jmp 0x78da1a

Function at 0x78e266
Capabilities:
Execute anti-debugging instructions

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + 0x648d13ec], al
and al, 0x46
mov edi, dword [esp]
bswap edx
rdtsc
jmp 0x78afb2
setb bh
mov si, word [esp]
not si
mov bp, sp
inc bh
stc
jmp 0x78afdf
sub esp, 1
lea ebp, reloc.KERNEL32.dll_GetDriveTypeA
shr cx, 1
mov ebx, dword [esp]
mov esi, esp
mov dx, 0xcf5d
jmp 0x78af9a
bswap ebp
mov eax, ebx
mov bx, si
bsf ebx, ebx
lea eax, reloc.KERNEL32.dll_GetDriveTypeA
jmp 0x78b011
mov di, word [esp]
bsr edx, esi
mov bx, si
mov bh, byte [esp]
inc bx
adc esi, 0xb682d530
jmp 0x78afc9
std
lea ecx, [esi*4]
setg dl
lea eax, [ebx*4]
cpuid
mov ecx, dword [esp]
jmp 0x78b040
rdtsc
sub esp, 8
mov ch, byte [esp + 5]
stc
xchg dword [esp + 3], eax
push word [esp + 2]
jmp 0x78b094
neg dx
mov ebp, edx
mov bx, 0xd098
rdtsc
xchg byte [esp + 6], al
call int.0078b17b
mov al, byte [0x448f66e3]
and al, 4
pop word [esp + 4]
lea esi, [ebx*4]
dec dh
bsr di, di
lea eax, [eax + 0xba]
neg di
jmp 0x78b07e
pop word [esp]
mov dword [esp + 3], ecx
lea esp, [esp + 0x10]
jmp 0x78e285
call fcn.0071dc22
jmp 0x791b0b
pop eax
jmp 0x791ae0
call 0x791ade
jmp 0x791ac3
sub eax, 0x791ade
mov ebx, eax
add eax, 0x66e710
jmp 0x791af3
add ebx, 0x5492e4
jmp 0x791b1e
call 0x791b10
add dword [esp], reloc.KERNEL32.dll_GetDriveTypeA
call fcn.0066e9b2
jmp 0x791ad9
mov dword [ebx], eax
popal
jmp 0x78af67
Function at 0x501900
Capabilities:
Create directory

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, edi
cmp byte [edi], 0
je 0x501936
cmp byte [esi], 0x5c
jne 0x501930
and byte [esi], 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x50192d
push edi
push 0x501008
call fcn.0050193b
mov byte [esi], 0x5c
inc esi
cmp byte [esi], 0
jne 0x50190d
pop edi
pop esi
ret 4

Function at 0x501afe
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x501b15
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x200]
push ecx
push eax
call fcn.00501b72
and byte [ebp - 0x100], 0
lea eax, [ebp - 0x100]
push 0x100
push eax
push 0x20000003
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x100]
push 0x10010
push eax
lea eax, [ebp - 0x200]
push eax
push dword [0x5055b0]
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.00501bbf
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x501e69
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
test edx, edx
je 0x501e97
push edi
push esi
movzx esi, byte [ecx]
movzx edi, al
xor esi, edi
mov edi, dword [0x5055b8]
shr eax, 8
mov esi, dword [edi + esi*4]
xor eax, esi
inc ecx
dec edx
jne 0x501e7b
pop esi
pop edi
ret 0xc

Function at 0x5036b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x5036f7
cmp edx, 0x10
jl 0x5036e3
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x5036d0
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x5036f7
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x5036ef
and edx, 3
cmp edx, 3
jne 0x50370b
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x503710
cmp edx, 2
jne 0x50371c
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x503721
cmp edx, 1
jne 0x503727
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x10016dc
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor ebx, ebx
test eax, eax
js 0x100172a
cmp al, 6
jb 0x100172a
push 0x10011b0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x100172a
push 0x10011cc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x100172a
push ebx
push ebx
push 1
push ebx
call eax
call fcn.010018cd
cmp dword [0x1003378], 2
jne 0x1001783
mov eax, dword [0x100336c]
cmp eax, 6
ja 0x100174c
jne 0x1001783
cmp dword [0x1003370], ebx
jbe 0x1001783
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], ebx
call dword [sym.imp.msvcrt.dll_rand_s]
pop ecx
test eax, eax
jne 0x1001783
movzx eax, byte [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
mov esi, ebx
je 0x1001783
push 1
push 0x2000
push 0x10000
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
inc esi
cmp esi, dword [ebp - 0x28]
jb 0x100176a
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x28]
push eax
push edi
call fcn.0100164b
mov esi, eax
cmp esi, ebx
jl 0x1001886
push 2
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
cmp esi, ebx
jl 0x1001886
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x28]
push eax
cmp edi, 6
je 0x1001848
push 0x10011e0
push 1
push ebx
push 0x1001210
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp esi, ebx
jl 0x1001880
cmp edi, 9
ja case.0x10017e8.6
jmp dword [edi*4 + 0x10018a0]
push ebx
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
jmp 0x1001875
push 1
jmp 0x10017f0
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
jmp 0x1001875
push 1
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
jmp 0x1001875
push ebx
jmp 0x100180c
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x18]
jmp 0x1001875
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
jmp 0x1001875
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
jmp 0x1001875
xor esi, esi
jmp 0x1001877
mov esi, 0x80004001
jmp 0x1001877
push 0x10011f0
push 1
push ebx
push 0x1001200
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp esi, ebx
jl 0x1001880
push dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
lea edx, [ebp - 0x24]
push edx
push eax
call dword [ecx + 0xc]
mov esi, eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp esi, ebx
pop edi
setl al
pop esi
xor ecx, ebp
pop ebx
call fcn.01001c0f
leave
ret 0x10
Function at 0x1001c00
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x10024e0
call fcn.01001da4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x1003418
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x10019bc
cmp eax, esi
jne 0x10019af
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10019bf
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001996
xor esi, esi
inc esi
mov eax, dword [0x1003414]
cmp eax, esi
jne 0x10019d2
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1001a01
mov eax, dword [0x1003414]
test eax, eax
jne 0x10019fb
mov dword [0x1003414], esi
push 0x10010d0
push 0x10010c4
call fcn.010018f8
pop ecx
pop ecx
test eax, eax
je 0x1001a01
jmp 0x1001b24
mov dword [0x1003034], esi
mov eax, dword [0x1003414]
cmp eax, esi
jne 0x1001a25
push 0x10010c0
push 0x10010b8
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1003414], 2
cmp dword [ebp - 0x20], ebx
jne 0x1001a32
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100341c], ebx
je 0x1001a53
push 0x100341c
call fcn.01001d19
pop ecx
test eax, eax
je 0x1001a53
push ebx
push 2
push ebx
call dword [0x100341c]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x1001b24
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp ecx, 0x20
ja 0x1001abc
cmp cx, bx
je 0x1001a77
cmp dword [ebp - 0x1c], ebx
jne 0x1001abc
movzx ecx, word [eax]
cmp cx, bx
je 0x1001a8c
cmp ecx, 0x20
ja 0x1001a8c
add eax, 2
mov dword [ebp - 0x24], eax
jmp 0x1001a77
test byte [ebp - 0x40], 1
je 0x1001a98
movzx ecx, word [ebp - 0x3c]
jmp 0x1001a9b
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x1003030], eax
cmp dword [0x1003024], ebx
jne 0x1001b01
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp ecx, 0x22
jne 0x1001acc
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
add eax, 2
jmp 0x1001a62
cmp dword [0x1003034], ebx
jne 0x1001b0f
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1003030]
jmp 0x1001b30
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01001de9
ret
call fcn.01001eec
jmp 0x1001959
Function at 0x405cbb
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c60c], 0
push esi
jne 0x405cf2
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405ccc
mov dword [ecx*4 + 0x42c608], eax
inc ecx
cmp ecx, 0x100
jl 0x405cc7
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405d23
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c608]
xor eax, esi
inc ecx
dec edx
jne 0x405d05
pop edi
not eax
pop esi
ret 0xc

Function at 0x401396
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
mov esi, ecx
cmp dword [0x40b0c4], edx
jne 0x4013d5
push ebx
push edi
push 8
mov ecx, edx
pop edi
mov ebx, ecx
and bl, 1
movzx ebx, bl
neg ebx
sbb ebx, ebx
and ebx, 0xedb88320
shr ecx, 1
xor ecx, ebx
dec edi
jne 0x4013aa
mov dword [edx*4 + 0x40b0c0], ecx
inc edx
cmp edx, 0x100
jl 0x4013a5
pop edi
pop ebx
not esi
jmp 0x4013f3
movzx ecx, byte [eax]
dec dword [esp + 8]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x40b0c0]
inc eax
cmp dword [esp + 8], 0
ja 0x4013d9
mov eax, esi
not eax
pop esi
ret 4
Function at 0x4011c6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d12c]
jne 0x4011d0
repz ret
jmp fcn.004029a2

Function at 0x403db3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004021c8
and dword [ebp - 4], 0
cmp dword [0x40ea54], 0
mov ebx, eax
jne 0x403e64
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x403f15
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x403f15
push eax
call fcn.00402156
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40ea54], eax
call esi
push eax
call fcn.00402156
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40ea58], eax
call esi
push eax
call fcn.00402156
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40ea5c], eax
call esi
push eax
call fcn.00402156
pop ecx
mov dword [0x40ea64], eax
test eax, eax
je 0x403e64
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402156
pop ecx
mov dword [0x40ea60], eax
mov eax, dword [0x40ea60]
cmp eax, ebx
je 0x403ebc
cmp dword [0x40ea64], ebx
je 0x403ebc
push eax
call fcn.004021d1
push dword [0x40ea64]
mov esi, eax
call fcn.004021d1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x403ebc
test edi, edi
je 0x403ebc
call esi
test eax, eax
je 0x403eb3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x403eb3
test byte [ebp - 0xc], 1
jne 0x403ebc
or dword [ebp + 0x10], 0x200000
jmp 0x403ef5
mov eax, dword [0x40ea58]
cmp eax, ebx
je 0x403ef5
push eax
call fcn.004021d1
pop ecx
test eax, eax
je 0x403ef5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x403ef5
mov eax, dword [0x40ea5c]
cmp eax, ebx
je 0x403ef5
push eax
call fcn.004021d1
pop ecx
test eax, eax
je 0x403ef5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40ea54]
call fcn.004021d1
pop ecx
test eax, eax
je 0x403f15
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x403f17
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4086e0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x40d12c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov byte [ebp - 1], 0
mov dword [ebp - 0x240], 0x22c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call sub.KERNEL32.dll_Process32FirstW
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x21c]
push eax
call fcn.004013bc
add esp, 8
test eax, eax
jne 0x408741
mov byte [ebp - 1], 1
jmp 0x408755
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x408724
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004011c6
mov esp, ebp
pop ebp
ret