joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4335b0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x499e2c]
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x14]
test eax, eax
je 0x433601
mov eax, dword [esp + 0x2c]
cmp eax, 1
je 0x4335f9
cmp eax, 2
je 0x4335f9
test ebp, ebp
je 0x4335e7
cmp eax, 0xfffffffa
jne 0x4335e7
mov esi, 1
mov ebx, edi
jmp 0x433605
test eax, eax
jne 0x433601
mov esi, 1
call fcn.0045f9b0
mov ebx, eax
jmp 0x433605
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret
mov ebx, dword [esp + 0x1c]
mov eax, dword [0x499e2c]
test eax, eax
je 0x43362c
test ebp, ebp
je 0x43362c
mov eax, dword [esp + 0x28]
test eax, eax
je 0x43362c
push ebx
call fcn.0045fa00
add esp, 4
push ebx
call fcn.0045faf0
add esp, 4
test esi, esi
je 0x43367c
mov eax, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
push ebx
push eax
push ebp
call fcn.0045fa60
mov edi, dword [esp + 0x2c]
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
mov dword [edi], esi
jne 0x433657
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
push 0
push ebx
push 2
push 0x491ea0
call fcn.0045fa40
mov byte [esi + ebp], 0xa
mov eax, dword [edi]
add esp, 0x10
inc eax
mov dword [edi], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push 0
push ecx
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
ret

Function at 0x435280
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.004336b0
mov eax, dword [0x499e2c]
mov esi, dword [esp + 8]
test eax, eax
je 0x4352a6
test esi, esi
je 0x43529b
mov eax, dword [esi]
jmp 0x43529d
xor eax, eax
push eax
call fcn.0045fae0
add esp, 4
test esi, esi
je 0x4352b9
mov esi, dword [esi]
push esi
call fcn.0044ad00
add esp, 4
pop esi
ret 4
xor esi, esi
push esi
call fcn.0044ad00
add esp, 4
pop esi
ret 4
Function at 0x443720
Capabilities:
Create process on windows
Delete file
Self delete

Disassembly:
sub esp, 0x31c
push ebx
push ebp
mov ebx, dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov esi, dword [esp + 0x32c]
push edi
xor edi, edi
mov eax, dword [esi + 0x118]
test al, 0x80
je 0x4437de
test al, 0x20
mov eax, dword [esi + 0x4c]
push eax
jne 0x443764
lea ecx, [esp + 0x24]
push ecx
call fcn.0044c100
add esp, 8
jmp 0x443785
push eax
lea edx, [esp + 0x28]
push str._s__DEL__s
push edx
call fcn.0044c100
mov eax, dword [esi + 0x118]
add esp, 0x10
and al, 0xdf
mov dword [esi + 0x118], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push 0x492430
push 0
push 0
push 0
push 1
push 0
push 0
push ecx
push 0
call ebx
test eax, eax
jne 0x4437b5
call ebp
mov dword [esi + 0xa4], eax
mov edi, 0xc000001c
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x4437d3
call ebp
mov dword [esi + 0xa4], eax
mov edi, 0xc000001c
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test byte [esi + 0x118], 0x40
je 0x44384f
mov ecx, dword [esi + 0x4c]
lea edx, [esp + 0x20]
push ecx
push str.PRINT__s
push edx
call fcn.0044c100
mov eax, dword [esi + 0x118]
add esp, 0xc
test al, 0x20
je 0x443814
and al, 0xdf
mov edi, 0x40000005
mov dword [esi + 0x118], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
push 0x492430
push 0
push 0
push 0
push 1
push 0
push 0
push ecx
push 0
call ebx
test eax, eax
jne 0x443844
call ebp
mov dword [esi + 0xa4], eax
mov edi, 0xc000001c
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x118]
test al, 0x20
je 0x4438ad
test al, 0x10
jne 0x4438ad
mov eax, dword [esi + 0x4c]
push 0
push 0x4000000
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x443892
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
mov ecx, dword [esi + 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4438ad
call ebp
mov dword [esi + 0xa4], eax
mov edi, 0xc000001c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret
Function at 0x450b10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
push ebx
push esi
push edi
mov dword [ebp - 8], 0
jmp 0x450b2e
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x12
jae 0x450b47
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx*8 + 0x492c60]
jne 0x450b45
jmp 0x450b47
jmp 0x450b25
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax*8 + 0x492c60]
jne 0x450cfa
cmp dword [ebp + 8], 0xfc
je 0x450b84
mov edx, dword [ebp - 8]
mov eax, dword [edx*8 + 0x492c64]
push eax
push 0
push 0
push 0
push 1
call fcn.004554d0
add esp, 0x14
cmp eax, 1
jne 0x450b84
int3
cmp dword [0x499aa8], 1
je 0x450b9f
cmp dword [0x499aa8], 0
jne 0x450c0a
cmp dword [0x4924dc], 1
jne 0x450c0a
cmp dword [0x4a34e0], 0
je 0x450bc5
mov ecx, dword [0x4a34e0]
cmp dword [ecx + 0x10], 0xffffffff
je 0x450bc5
mov edx, dword [0x4a34e0]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x1b4], eax
jmp 0x450bd3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x1b4], eax
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx*8 + 0x492c64]
push eax
call fcn.00455bc0
add esp, 4
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx*8 + 0x492c64]
push edx
mov eax, dword [ebp - 0x1b4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x450cfa
cmp dword [ebp + 8], 0xfc
je 0x450cfa
push 0x104
lea ecx, [ebp - 0x110]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x450c43
push str._program_name_unknown_
lea edx, [ebp - 0x110]
push edx
call fcn.004594a0
add esp, 8
lea eax, [ebp - 0x110]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00455bc0
add esp, 4
add eax, 1
cmp eax, 0x3c
jbe 0x450c8c
lea edx, [ebp - 0x110]
push edx
call fcn.00455bc0
add esp, 4
mov ecx, dword [ebp - 0xc]
lea edx, [ecx + eax - 0x3b]
mov dword [ebp - 0xc], edx
push 3
push 0x474bcc
mov eax, dword [ebp - 0xc]
push eax
call fcn.0044c290
add esp, 0xc
push str.Runtime_Error__n_nProgram:
lea ecx, [ebp - 0x1b0]
push ecx
call fcn.004594a0
add esp, 8
mov edx, dword [ebp - 0xc]
push edx
lea eax, [ebp - 0x1b0]
push eax
call fcn.004594b0
add esp, 8
push 0x474bac
lea ecx, [ebp - 0x1b0]
push ecx
call fcn.004594b0
add esp, 8
mov edx, dword [ebp - 8]
mov eax, dword [edx*8 + 0x492c64]
push eax
lea ecx, [ebp - 0x1b0]
push ecx
call fcn.004594b0
add esp, 8
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
lea edx, [ebp - 0x1b0]
push edx
call fcn.00459900
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406e40
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._main
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop

Function at 0x407090
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call sym.___main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x40710d
cmp al, 9
je 0x407100
cmp al, 0x20
je 0x407100
mov dword [ebp - 0x54], 0
xor edi, edi
nop
cmp al, 0x5c
je 0x407160
cmp al, 0x22
je 0x407170
mov dword [ebp - 0x54], 0
movzx eax, byte [ebx + 1]
inc ebx
test al, al
je 0x40710d
cmp al, 9
sete cl
cmp al, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x4070c0
test edi, 1
jne 0x4070c0
lea esi, [esi]
movzx eax, byte [ebx + 1]
inc ebx
cmp al, 9
je 0x407100
cmp al, 0x20
je 0x407100
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x24], 1
jne 0x407128
mov word [ebp - 0x20], 1
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
inc dword [ebp - 0x54]
jmp 0x4070d7
and dword [ebp - 0x54], 1
jne 0x4070d0
xor edi, 1
jmp 0x4070d7

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x42b5e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x15000]
push edi
or ebp, 0xffffffff
jmp 0x42b602
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42b609
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42b5f8
mov eax, 1
add ebx, ebx
jne 0x42b61b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42b610
jne 0x42b62c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42b610
xor ecx, ecx
sub eax, 3
jb 0x42b640
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42b6b2
mov ebp, eax
add ebx, ebx
jne 0x42b64b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42b658
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42b67c
inc ecx
add ebx, ebx
jne 0x42b668
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42b65d
jne 0x42b679
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42b65d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42b69c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42b68d
jmp 0x42b5fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42b69c
add edi, ecx
jmp 0x42b5fe
pop esi
mov edi, esi
mov ecx, 0x3e7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42b6ba
cmp byte [edi], 1
jne 0x42b6ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42b6bf
lea edi, [esi + 0x29000]
mov eax, dword [edi]
or eax, eax
je 0x42b737
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2c688]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2c73c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42b6ec
mov ecx, edi
jns 0x42b71b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2c740]
or eax, eax
je 0x42b731
mov dword [ebx], eax
add ebx, 4
jmp 0x42b709
call dword [esi + 0x2c748]
mov ebp, dword [esi + 0x2c744]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42b76b
sub esp, 0xffffff80
jmp 0x40d841

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x10001f75
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x10027a3c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0x11c]
jne 0x10001fb5
push 0x1001f8d0
push 4
push eax
call fcn.1000dfc7
push eax
call fcn.10001000
add esp, 0x10
jmp 0x10001fc7
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x10002035
push edi
call fcn.1000d9aa
mov edi, dword [eax]
call fcn.1000d9aa
and dword [eax], 0
lea eax, [ebp - 0x11c]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.1000e048
add esp, 0x18
mov ebx, eax
call fcn.1000d9aa
cmp dword [eax], 0
je 0x10002015
call fcn.1000d9aa
push dword [eax]
call fcn.10001663
pop ecx
jmp 0x1000201c
call fcn.1000d9aa
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x10002035
cmp ebx, esi
jae 0x10002035
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x10002037
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1000cc7f
leave
ret
Function at 0x1000cc7f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10027a3c]
jne 0x1000cc89
repz ret
jmp fcn.100116d5

Function at 0x10011037
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10027d18]
je 0x10011052
inc edi
cmp edi, 0x17
jb 0x10011043
cmp edi, 0x17
jae 0x100111d2
push ebp
push 3
call fcn.1001816f
cmp eax, 1
pop ecx
je 0x1001119e
push 3
call fcn.1001816f
test eax, eax
pop ecx
jne 0x10011086
cmp dword [0x1002ad00], 1
je 0x1001119e
cmp ebx, 0xfc
je 0x100111d1
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x1002aeb8
push ebp
call fcn.1000dfc7
add esp, 0xc
test eax, eax
je 0x100110bc
push esi
push esi
push esi
push esi
push esi
call fcn.10011246
add esp, 0x14
push 0x104
mov esi, 0x1002aed1
push esi
push 0
mov byte [0x1002afd5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10011100
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1000dfc7
add esp, 0xc
test eax, eax
je 0x10011100
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.10011246
add esp, 0x14
push esi
call fcn.1000d830
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10011145
push esi
call fcn.1000d830
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1002b1cc
push 0x10020fd4
sub ecx, eax
push ecx
push eax
call fcn.1000fed2
add esp, 0x14
test eax, eax
je 0x10011145
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.10011246
add esp, 0x14
jmp 0x10011147
xor esi, esi
push 0x10020fd0
push ebx
push ebp
call fcn.1000e171
add esp, 0xc
test eax, eax
je 0x10011167
push esi
push esi
push esi
push esi
push esi
call fcn.10011246
add esp, 0x14
push dword [edi*8 + 0x10027d1c]
push ebx
push ebp
call fcn.1000e171
add esp, 0xc
test eax, eax
je 0x10011189
push esi
push esi
push esi
push esi
push esi
call fcn.10011246
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.10017fb2
add esp, 0xc
jmp 0x100111d1
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x100111d1
cmp ebp, 0xffffffff
je 0x100111d1
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x10027d1c]
push dword [esi]
call fcn.1000d830
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10017fb2
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.100127cf
xor ebx, ebx
cmp dword [0x1002b784], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x10018088
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10018168
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10021a08
push edi
call esi
cmp eax, ebx
je 0x10018168
push eax
call fcn.10012761
mov dword [esp], 0x100219f8
push edi
mov dword [0x1002b784], eax
call esi
push eax
call fcn.10012761
mov dword [esp], 0x100219e4
push edi
mov dword [0x1002b788], eax
call esi
push eax
call fcn.10012761
mov dword [0x1002b78c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.1000da97
test eax, eax
pop ecx
pop ecx
je 0x10018056
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10011246
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x10018088
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10012761
cmp eax, ebx
pop ecx
mov dword [0x1002b794], eax
je 0x10018088
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10012761
pop ecx
mov dword [0x1002b790], eax
mov eax, dword [0x1002b790]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x1001810d
cmp dword [0x1002b794], ecx
je 0x1001810d
push eax
call fcn.100127d8
push dword [0x1002b794]
mov esi, eax
call fcn.100127d8
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x1001810d
cmp edi, ebx
je 0x1001810d
call esi
cmp eax, ebx
je 0x100180da
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100180da
test byte [ebp - 0x18], 1
jne 0x1001810d
lea eax, [ebp - 0x10]
push eax
call fcn.1000dace
test eax, eax
pop ecx
je 0x100180f5
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10011246
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x10018104
or dword [ebp + 0x10], 0x200000
jmp 0x10018148
or dword [ebp + 0x10], 0x40000
jmp 0x10018148
mov eax, dword [0x1002b788]
cmp eax, dword [ebp - 8]
je 0x10018148
push eax
call fcn.100127d8
cmp eax, ebx
pop ecx
je 0x10018148
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10018148
mov eax, dword [0x1002b78c]
cmp eax, dword [ebp - 8]
je 0x10018148
push eax
call fcn.100127d8
cmp eax, ebx
pop ecx
je 0x10018148
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1002b784]
call fcn.100127d8
cmp eax, ebx
pop ecx
je 0x10018168
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001816a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405e43
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], 1
mov esi, ecx
mov dword [ebp - 0xc], edi
xorps xmm0, xmm0
mov dword [ebp - 0x14], esi
movsd qword [ebp - 0x20], xmm0
jmp 0x405e79
inc esi
movzx eax, byte [esi]
push eax
call fcn.00453db0
pop ecx
test eax, eax
jne 0x405e78
mov al, byte [esi]
cmp al, 0x2d
jne 0x405e93
or dword [ebp - 0x10], 0xffffffff
jmp 0x405e97
cmp al, 0x2b
jne 0x405e9a
inc esi
mov al, byte [esi]
movzx eax, al
jmp 0x405ec7
movsx eax, byte [esi]
movsd xmm1, qword [ebp - 0x20]
sub eax, 0x30
mulsd xmm1, qword [0x47f0a8]
inc esi
movd xmm0, eax
movzx eax, byte [esi]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
movsd qword [ebp - 0x20], xmm1
push eax
call fcn.00453c90
pop ecx
test eax, eax
jne 0x405e9f
mov al, byte [esi]
movsd xmm0, qword [0x47f098]
movsd qword [ebp - 0x28], xmm0
cmp al, 0x2e
jne 0x405f42
movsd qword [ebp - 8], xmm0
jmp 0x405f22
movsx eax, byte [esi]
movsd xmm1, qword [ebp - 0x20]
sub eax, 0x30
mulsd xmm1, qword [0x47f0a8]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
movsd xmm0, qword [ebp - 8]
mulsd xmm0, qword [0x47f0a8]
movsd qword [ebp - 0x20], xmm1
movsd qword [ebp - 8], xmm0
inc esi
movzx eax, byte [esi]
push eax
call fcn.00453c90
pop ecx
test eax, eax
jne 0x405eec
movsd xmm0, qword [ebp - 0x20]
divsd xmm0, qword [ebp - 8]
mov al, byte [esi]
movsd qword [ebp - 0x20], xmm0
cmp al, 0x65
je 0x405f4e
cmp al, 0x45
jne 0x40603a
xor edi, edi
mov dword [ebp - 4], 1
inc esi
mov al, byte [esi]
cmp al, 0x2d
jne 0x405f64
or dword [ebp - 4], 0xffffffff
jmp 0x405f68
cmp al, 0x2b
jne 0x405f6b
inc esi
mov al, byte [esi]
movzx eax, al
push eax
call fcn.00453c90
pop ecx
test eax, eax
je 0x406019
imul ecx, edi, 0xa
movsx edi, byte [esi]
add ecx, 0xffffffd0
add edi, ecx
inc esi
movzx eax, byte [esi]
push eax
call fcn.00453c90
pop ecx
test eax, eax
jne 0x405f7d
movsd xmm0, qword [0x47f098]
cmp edi, 0x40
jl 0x405fc0
mov ecx, edi
shr ecx, 6
imul eax, ecx, 0xffffffc0
add edi, eax
mulsd xmm0, qword [0x47f118]
sub ecx, 1
jne 0x405fae
movsd qword [ebp - 0x28], xmm0
cmp edi, 0x10
jl 0x405fe1
mov ecx, edi
shr ecx, 4
imul eax, ecx, 0xfffffff0
add edi, eax
mulsd xmm0, qword [0x47f100]
sub ecx, 1
jne 0x405fcf
movsd qword [ebp - 0x28], xmm0
cmp edi, 4
jl 0x406002
mov ecx, edi
shr ecx, 2
imul eax, ecx, 0xfffffffc
add edi, eax
mulsd xmm0, qword [0x47f0d0]
sub ecx, 1
jne 0x405ff0
movsd qword [ebp - 0x28], xmm0
cmp edi, 1
jl 0x406019
mulsd xmm0, qword [0x47f0a8]
sub edi, 1
jne 0x406007
movsd qword [ebp - 0x28], xmm0
cmp dword [ebp - 4], 0
mov edi, dword [ebp - 0xc]
jge 0x40602e
movsd xmm0, qword [ebp - 0x20]
divsd xmm0, qword [ebp - 0x28]
jmp 0x40603f
movsd xmm0, qword [ebp - 0x28]
mulsd xmm0, qword [ebp - 0x20]
jmp 0x40603f
movsd xmm0, qword [ebp - 0x20]
cmp dword [ebp - 0x10], 0
jge 0x40604c
xorps xmm0, xmmword [0x47f590]
sub esi, dword [ebp - 0x14]
movsd qword [edi], xmm0
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x41824c
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
test edi, edi
je 0x418317
push 0x48
pop edx
call fcn.00404223
mov esi, eax
test esi, esi
je 0x418317
mov cl, byte [edi + 5]
mov byte [esi + 5], cl
mov ecx, ebx
mov edx, dword [edi]
call fcn.00417fe2
mov dword [esi], eax
mov ecx, ebx
mov edx, dword [edi + 0xc]
call fcn.004180bb
mov dword [esi + 0xc], eax
mov ecx, ebx
mov edx, dword [edi + 0x10]
call fcn.00417f0b
mov dword [esi + 0x10], eax
mov ecx, ebx
mov edx, dword [edi + 0x14]
call fcn.00417fe2
mov dword [esi + 0x14], eax
mov ecx, ebx
mov edx, dword [edi + 0x18]
call fcn.00417f0b
mov dword [esi + 0x18], eax
mov ecx, ebx
mov edx, dword [edi + 0x1c]
call fcn.00417fe2
mov dword [esi + 0x1c], eax
mov ecx, ebx
mov al, byte [edi + 4]
mov byte [esi + 4], al
mov edx, dword [edi + 0x20]
call fcn.0041824c
mov dword [esi + 0x20], eax
mov ecx, ebx
mov edx, dword [edi + 0x2c]
call fcn.00417f0b
mov dword [esi + 0x2c], eax
mov ecx, ebx
mov edx, dword [edi + 0x30]
call fcn.00417f0b
or ecx, 0xffffffff
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], ecx
mov al, byte [edi + 6]
mov byte [esi + 6], al
mov al, byte [edi + 7]
mov byte [esi + 7], al
xor eax, eax
mov word [esi + 8], ax
mov dword [esi + 0x28], eax
mov eax, esi
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], ecx
jmp 0x418319
xor eax, eax
pop edi
pop esi
pop ebx
ret