joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417830
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x417955
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00417638
mov esi, eax
mov eax, dword [0x43d410]
cmp byte [eax], 0
je 0x4178fd
mov eax, dword [0x43d338]
call fcn.004044b8
call fcn.00403d30
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x417800]
call fcn.00406a90
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x417970
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x417939
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x43d314]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x440c44]
call fcn.00406b48
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41795c
lea eax, [ebp - 4]
mov edx, dword [0x417800]
call fcn.00406a9c
ret

Function at 0x418a14
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00405e68
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00408170
mov edi, eax
cmp edi, 0x104
jbe 0x4189bb
mov eax, edi
add eax, eax
call fcn.00403bdc
mov esi, eax
jmp 0x4189bd
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00408170
mov eax, esi
push eax
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4189f8
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4189e2
mov eax, esp
cmp esi, eax
je 0x418a05
mov eax, esi
call fcn.00403bf8
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x418a40
cmp bl, 0
je 0x418a3c
cmp bl, 0x41
jl 0x418a37
cmp bl, 0x5a
jg 0x418a37
or bl, 0x20
xor al, bl
inc esi
jmp 0x418a1b
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x41897c

Function at 0x418c60
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.00406090
add esp, 0x800
pop ebx
ret
Function at 0x418f4c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff800
mov esi, edx
mov edi, eax
mov eax, esi
call fcn.00405ab4
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.00405ffc
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
mov ebx, eax
cmp ebx, 0x400
jge 0x418f91
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.00405bf0
jmp 0x418faa
mov edx, ebx
dec edx
mov eax, esi
call fcn.004060e8
push ebx
mov eax, dword [esi]
call fcn.00405ffc
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
add esp, 0x800
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x41c1fc
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x43b20c
test edx, edx
jne 0x41c21b
xor eax, eax
jmp 0x41c339
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x41c238
push esi
push edx
push eax
call fcn.0041c340
add esp, 0xc
jmp 0x41c339
push esi
push edx
push eax
call fcn.0041c600
add esp, 0xc
jmp 0x41c339
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4347c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
call sub.kernel32.dll_FindResourceW
mov edi, eax
mov dword [ebx + 0x14], edi
push edi
push esi
call sub.kernel32.dll_LoadResource
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x14]
push eax
push esi
call sub.kernel32.dll_SizeofResource
push eax
mov eax, dword [ebx + 0x18]
push eax
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, ebx
pop ecx
call fcn.00434814
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x434a68
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x434afd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x434b18
push ebx
push 0x434b28
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00406248
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00404528
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405ffc
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x434ae7
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434b04
lea eax, [ebp - 4]
call fcn.00405ab4
ret
Function at 0x434b30
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcb8
xor eax, eax
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x338], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x434d17
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x338]
call fcn.00434878
mov edx, dword [ebp - 0x338]
lea eax, [ebp - 4]
mov ecx, 0x434d30
call fcn.004061c0
xor ecx, ecx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x2e0]
call fcn.004043d0
call fcn.00403d30
lea eax, [ebp - 0x2e0]
call fcn.00404090
call fcn.00403d30
mov edx, 0x434d58
lea eax, [ebp - 0x2e0]
call fcn.00404a84
call fcn.00404b84
call fcn.00403d30
push 0x434d70
lea edx, [ebp - 0x340]
xor eax, eax
call fcn.00403f9c
push dword [ebp - 0x340]
push 0x434d88
lea eax, [ebp - 0x33c]
mov edx, 3
call fcn.00406248
mov edx, dword [ebp - 0x33c]
lea eax, [ebp - 0x2e0]
call fcn.00404a84
call fcn.00404b84
call fcn.00403d30
push 0x434d98
lea edx, [ebp - 0x348]
xor eax, eax
call fcn.00403f9c
push dword [ebp - 0x348]
push 0x434d88
push 0x434dbc
lea eax, [ebp - 0x344]
mov edx, 4
call fcn.00406248
mov edx, dword [ebp - 0x344]
lea eax, [ebp - 0x2e0]
call fcn.00404a84
call fcn.00404b84
call fcn.00403d30
mov edx, 0x434ddc
lea eax, [ebp - 0x2e0]
call fcn.00404a84
call fcn.00404b84
call fcn.00403d30
lea eax, [ebp - 0x2e0]
call fcn.004044d0
call fcn.00403d30
lea eax, [ebp - 0x334]
xor ecx, ecx
mov edx, 0x44
call fcn.00404528
mov dword [ebp - 0x308], 1
mov word [ebp - 0x304], 0
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x334]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00405ffc
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x434cf1
mov eax, dword [ebp - 0x2ec]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x2f0]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434d1e
lea eax, [ebp - 0x348]
mov edx, 5
call fcn.00405b14
lea eax, [ebp - 4]
call fcn.00405ab4
ret
Function at 0x434f8c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
xor eax, eax
push ebp
push 0x43507c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x442ee8]
call fcn.00405ffc
mov edx, eax
lea eax, [ebp - 8]
call fcn.00406054
mov eax, dword [ebp - 8]
mov edx, 0x40
call fcn.00414e48
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x43505a
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ecx, eax
mov eax, ecx
sub eax, 0x13f
xor edx, edx
push edx
push eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00414f5c
mov edx, 0x442f00
mov ecx, 0x13f
mov eax, dword [ebp - 4]
call fcn.00414f04
cmp byte [0x44303c], 0
je 0x435033
lea edx, [ebp - 0xc]
mov eax, dword [0x442ee8]
call fcn.004152b8
mov edx, dword [ebp - 0xc]
mov eax, 0x442ef4
mov ecx, 0x435094
call fcn.004061c0
jmp 0x435043
mov eax, 0x442ef4
mov edx, dword [0x442ee8]
call fcn.00405d6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435061
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x5b3000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
push ebx
push esi
mov ebx, edx
mov dword [esp + 0x14], ecx
push edi
mov dword [esp + 0x1c], ebx
mov edi, ecx
xor eax, eax
nop dword [eax]
mov byte [esp + eax + 0xc], al
inc eax
cmp eax, 8
jb 0x5b3020
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx]
xor eax, ecx
rol ecx, 3
mov dword [esp + 0x20], eax
mov eax, dword [edx + 4]
xor eax, ecx
rol ecx, 3
mov dword [esp + 0x24], eax
mov eax, dword [edx + 8]
xor eax, ecx
rol ecx, 3
xor ecx, dword [edx + 0xc]
mov dword [esp + 0x2c], ecx
xor ecx, ecx
mov dword [esp + 0x28], eax
xor edx, edx
nop
mov eax, ecx
and eax, 3
mov eax, dword [esp + eax*4 + 0x20]
add eax, ecx
sub ecx, 0x61c88647
mov dword [esp + edx*4 + 0x30], eax
mov eax, ecx
sar eax, 0xb
and eax, 3
mov eax, dword [esp + eax*4 + 0x20]
add eax, ecx
mov dword [esp + edx*4 + 0xb0], eax
inc edx
cmp edx, 0x20
jl 0x5b3060
cmp edi, ebx
jae 0x5b31f2
lea esi, [esp + 0x30]
nop dword [eax]
mov ebx, dword [esp + 0xc]
xor edi, edi
mov eax, dword [esp + 0x10]
nop word [eax + eax]
mov edx, eax
mov ecx, eax
shr edx, 5
shl ecx, 4
xor edx, ecx
add edx, eax
xor edx, dword [esi + edi*4]
lea esi, [edx + ebx]
mov edx, esi
mov ecx, esi
shr edx, 5
shl ecx, 4
xor ecx, edx
add ecx, esi
xor ecx, dword [esp + edi*4 + 0xb0]
add ecx, eax
mov edx, ecx
mov eax, ecx
shl eax, 4
shr edx, 5
xor edx, eax
lea eax, [esp + 0x34]
add edx, ecx
xor edx, dword [eax + edi*4]
add edx, esi
mov esi, edx
mov eax, edx
shl eax, 4
shr esi, 5
xor esi, eax
lea eax, [esp + 0xb4]
add esi, edx
xor esi, dword [eax + edi*4]
add esi, ecx
mov ecx, esi
mov eax, esi
shl eax, 4
shr ecx, 5
xor ecx, eax
lea eax, [esp + 0x38]
add ecx, esi
xor ecx, dword [eax + edi*4]
add ecx, edx
mov edx, ecx
mov dword [esp + 0x14], ecx
mov eax, ecx
shr edx, 5
shl eax, 4
xor edx, eax
lea eax, [esp + 0xb8]
add edx, ecx
xor edx, dword [eax + edi*4]
add edx, esi
lea esi, [esp + 0x30]
mov ebx, edx
mov dword [esp + 0x14], edx
shr ebx, 5
mov eax, edx
shl eax, 4
xor ebx, eax
lea eax, [esp + 0x3c]
add ebx, edx
xor ebx, dword [eax + edi*4]
add ebx, ecx
mov eax, ebx
mov ecx, ebx
shr eax, 5
shl ecx, 4
xor eax, ecx
lea ecx, [esp + 0xbc]
add eax, ebx
xor eax, dword [ecx + edi*4]
add edi, 4
add eax, edx
cmp edi, 0x20
jl 0x5b30b0
mov edi, dword [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x14]
mov bl, byte [edi]
mov byte [esp + 0xc], ch
mov dl, bl
xor dl, cl
mov dword [esp + 0x10], eax
movzx ecx, byte [esp + 0xe]
cmp byte [ebp + 0x10], 0
mov byte [esp + 0xd], cl
movzx ecx, byte [esp + 0xf]
mov byte [esp + 0xf], al
mov byte [esp + 0x10], ah
movzx eax, byte [esp + 0x12]
mov byte [esp + 0x11], al
movzx eax, byte [esp + 0x13]
mov byte [esp + 0xe], cl
mov byte [esp + 0x12], al
movzx ecx, dl
movzx eax, bl
cmovne ecx, eax
mov byte [edi], dl
inc edi
mov byte [esp + 0x13], cl
mov dword [esp + 0x18], edi
cmp edi, dword [esp + 0x1c]
jb 0x5b30a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b3390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ecx + 0x3c]
push ebx
push esi
push edi
mov ebx, dword [eax + ecx + 0x78]
xor esi, esi
mov eax, dword [ebx + ecx + 0x24]
add ebx, ecx
mov dword [ebp - 8], edx
add eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], eax
mov edx, dword [ebx + 0x1c]
mov edi, dword [ebx + 0x20]
add edx, ecx
add edi, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edi
cmp dword [ebx + 0x18], esi
jbe 0x5b3425
nop dword [eax + eax]
movzx eax, word [eax + esi*2]
cmp eax, dword [ebx + 0x14]
jae 0x5b341c
mov edi, dword [edi + esi*4]
mov eax, dword [edx + eax*4]
add edi, ecx
add eax, ecx
mov dword [ebp - 4], eax
xor eax, eax
mov cl, byte [edi]
test cl, cl
je 0x5b3401
mov edx, edi
rol eax, 3
lea edx, [edx + 1]
movsx ecx, cl
add eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x5b33f0
push dword [ebp + 8]
push dword [ebp - 4]
push eax
push edi
call dword [ebp - 8]
add esp, 0x10
test al, al
jne 0x5b3425
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x5b33d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b4100
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
push ebx
xor eax, 0xb6a80f94
mov dword [ebp - 0x1c], 0xaa7575b3
mov dword [ebp - 0x18], 0xf0a59521
mov dword [ebp - 0x14], 0x315b1289
mov dword [ebp - 0x10], 0x5985ddca
push esi
push edi
cmp eax, 0xb6a80f95
jne 0x5b431f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
mov eax, dword [eax + edx + 0xc0]
mov ecx, eax
xor ecx, 0xda1b40fb
lea esi, [eax + edx]
xor eax, eax
cmp ecx, 0xda1b40fb
cmove esi, eax
mov eax, esi
xor eax, 0xafc6d059
cmp eax, 0xafc6d059
je 0x5b431f
mov ebx, dword [esi + 0xc]
lea eax, [ebp - 0x1c]
push 0
push 0xf67b7b8d
push eax
lea edx, [esi + 0x340]
mov dword [ebp - 0xc], ebx
lea ecx, [esi + 0xd8]
call section..gcode
mov eax, dword [ebx + 4]
add esp, 0xc
xor eax, 0x92f2b834
cmp eax, 0x92f2b834
je 0x5b431f
mov eax, dword fs:[0x18]
xor edx, edx
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 8]
mov eax, dword fs:[0x18]
lea edi, [ebx + 0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x3c]
movzx eax, word [ecx + ebx + 0x14]
add eax, ecx
add edi, eax
movzx eax, word [ecx + ebx + 6]
xor ecx, ecx
mov dword [ebp - 8], edi
mov dword [ebp + 0xc], eax
cmp cx, ax
jae 0x5b431f
nop dword [eax]
movzx eax, dx
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0xc]
lea edi, [edi + eax*8]
lea eax, [ecx + ebx]
cmp eax, entry1
ja 0x5b4215
mov eax, dword [edi + 0x10]
add eax, ecx
add eax, ebx
cmp eax, entry1
ja 0x5b4225
inc edx
cmp dx, word [ebp + 0xc]
jae 0x5b431f
mov edi, dword [ebp - 8]
jmp 0x5b41f0
mov eax, edi
xor eax, 0x9e971434
cmp eax, 0x9e971434
je 0x5b431f
mov eax, dword fs:[0x18]
mov ecx, dword [edi + 0xc]
mov edi, dword [edi + 0x10]
add edi, ecx
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
add edi, edx
lea eax, [ecx + edx]
cmp eax, edi
jae 0x5b431f
mov ebx, dword [esi + 0x318]
nop
mov edx, dword [eax + 4]
mov ecx, ebx
xor ecx, dword [eax]
xor edx, dword [esi + 0x31c]
xor ecx, 0x45ecc763
xor edx, 0
cmp ecx, 0x45ecc763
jne 0x5b42f7
test edx, edx
jne 0x5b42f7
mov ecx, dword [esi + 0x320]
xor ecx, dword [eax + 8]
mov edx, dword [esi + 0x324]
xor ecx, 0xc3464624
xor edx, dword [eax + 0xc]
xor edx, 0
cmp ecx, 0xc3464624
jne 0x5b42f7
test edx, edx
jne 0x5b42f7
mov ecx, dword [esi + 0x328]
xor ecx, dword [eax + 0x10]
mov edx, dword [esi + 0x32c]
xor ecx, 0x5ce40551
xor edx, dword [eax + 0x14]
xor edx, 0
cmp ecx, 0x5ce40551
jne 0x5b42f7
test edx, edx
jne 0x5b42f7
mov ecx, dword [esi + 0x330]
xor ecx, dword [eax + 0x18]
mov edx, dword [esi + 0x334]
xor ecx, 0x15070819
xor edx, dword [eax + 0x1c]
xor edx, 0
cmp ecx, 0x15070819
jne 0x5b42f7
test edx, edx
je 0x5b4309
inc eax
cmp eax, edi
jb 0x5b4260
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, eax
xor ecx, 0x25c43834
cmp ecx, 0x25c43834
je 0x5b431f
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x472004]
jne 0x40100a
repz ret
jmp fcn.00401729

Function at 0x4065f8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402452
and dword [ebp - 4], 0
cmp dword [0x473ce4], 0
mov ebx, eax
jne 0x4066a9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40675a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40675a
push eax
call fcn.004023e0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x473ce4], eax
call esi
push eax
call fcn.004023e0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x473ce8], eax
call esi
push eax
call fcn.004023e0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x473cec], eax
call esi
push eax
call fcn.004023e0
pop ecx
mov dword [0x473cf4], eax
test eax, eax
je 0x4066a9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004023e0
pop ecx
mov dword [0x473cf0], eax
mov eax, dword [0x473cf0]
cmp eax, ebx
je 0x406701
cmp dword [0x473cf4], ebx
je 0x406701
push eax
call fcn.0040245b
push dword [0x473cf4]
mov esi, eax
call fcn.0040245b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406701
test edi, edi
je 0x406701
call esi
test eax, eax
je 0x4066f8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4066f8
test byte [ebp - 0xc], 1
jne 0x406701
or dword [ebp + 0x10], 0x200000
jmp 0x40673a
mov eax, dword [0x473ce8]
cmp eax, ebx
je 0x40673a
push eax
call fcn.0040245b
pop ecx
test eax, eax
je 0x40673a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40673a
mov eax, dword [0x473cec]
cmp eax, ebx
je 0x40673a
push eax
call fcn.0040245b
pop ecx
test eax, eax
je 0x40673a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x473ce4]
call fcn.0040245b
pop ecx
test eax, eax
je 0x40675a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40675c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46e780
Capabilities:
Get hostname

Disassembly:
sub esp, 0x42c
mov eax, dword [0x472004]
xor eax, esp
mov dword [esp + 0x428], eax
cmp edi, 0x182
jne 0x46e7ab
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
jmp 0x46e7df
cmp edi, 0x19f
jne 0x46e7df
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push str.fihiresaduduvakuzafanenazewuduhe
push str.vabunayadedifecibu
push str.yosavagenisusoluselidesuli
push str.nibezitihomoyaradilocaxihenazigo
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push esi
xor esi, esi
test edi, edi
jle 0x46e852
jmp 0x46e7f0
lea ecx, [esp + 8]
mov dword [esp + 4], 5
mov dword [esp + 8], 0
call fcn.0046e770
mov eax, dword [esp + 8]
add eax, 0x46
mov dword [esp + 4], eax
sub dword [esp + 4], 0x46
mov cl, byte [esp + 4]
xor byte [ebx + esi], cl
cmp edi, 0xf
jne 0x46e84d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
inc esi
cmp esi, edi
jl 0x46e7f0
pop esi
cmp edi, 0x2d
jne 0x46e86c
mov dword [0x2b71f00], 0xa62e7790
mov dword [0x2b71f04], 0xffffffff
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.00401000
add esp, 0x42c
ret
Function at 0xa3c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa3c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa3c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa3c06a
add dl, dl
jne 0xa3c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa3c0dc
xor eax, eax
add dl, dl
jne 0xa3c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa3c17d
add dl, dl
jne 0xa3c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa3c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa3c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa3c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa3c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa3c075
mov eax, 1
add dl, dl
jne 0xa3c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa3c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa3c0e1
sub eax, ebx
mov ebx, 1
jne 0xa3c128
mov ecx, 1
add dl, dl
jne 0xa3c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa3c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa3c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa3c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa3c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa3c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa3c136
cmp eax, 0x7d00
jae 0xa3c16d
cmp eax, 0x500
jb 0xa3c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa3c075
cmp eax, 0x7f
ja 0xa3c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa3c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa3c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa3c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10