joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4589b8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.004580b0
test byte [ebp + 0xd], 0xc0
jne 0x4589dc
mov eax, dword [0x4646b8]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4589e9
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x458a16
je 0x458a28
sub ecx, 0x100
je 0x458a36
sub ecx, 0x100
je 0x458a3d
sub ecx, 0x100
je 0x458a2f
jmp 0x458a44
sub ecx, 0x600
je 0x458a3d
sub ecx, 0x100
je 0x458a28
jmp 0x458a44
mov edi, 1
jmp 0x458a49
mov edi, 2
jmp 0x458a49
mov edi, 4
jmp 0x458a49
mov edi, 5
jmp 0x458a49
mov edi, 3
test byte [ebp + 0xd], 1
je 0x458a70
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x464c90]
test al, 0x80
je 0x458a69
mov ebx, 0x80
jmp 0x458a82
mov ebx, 1
jmp 0x458a82
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x458a82
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x458a94
je 0x458a9d
dec eax
je 0x458aa6
jmp 0x458aaf
mov dword [ebp - 4], 0x80000000
jmp 0x458abe
mov dword [ebp - 4], 0x40000000
jmp 0x458abe
mov dword [ebp - 4], 0xc0000000
jmp 0x458abe
push 1
call fcn.00458470
pop ecx
mov ebx, eax
jmp 0x458baa
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x458ada
sub eax, 0x10
je 0x458ae1
sub eax, 0x10
je 0x458aea
sub eax, 0x10
je 0x458af3
jmp 0x458af3
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x458afa
mov dword [ebp - 8], 1
jmp 0x458afa
mov dword [ebp - 8], 2
jmp 0x458afa
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x458b63
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x458b58
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x458b58
add ebx, 0xffffffb2
push ebx
call fcn.00458470
pop ecx
mov ebx, eax
jmp 0x458baa
mov edi, esi
push edi
call fcn.0045891c
pop ecx
test eax, eax
je 0x458b77
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x458b83
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004581b0
add esp, 8
mov ebx, eax
inc eax
jne 0x458baa
push 4
call fcn.00458470
pop ecx
push esi
call sub.KERNEL32.dll_CloseHandle
call fcn.004580e4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x459b00
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x45a354
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
cmp dword [0x4650a0], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x45a40c
cmp byte [0x45d059], 0
je 0x45a3c6
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x54]
push edx
call fcn.00453124
add esp, 8
mov ebx, eax
test eax, eax
jne 0x45a3af
push 0x3a
lea edx, [ebp - 0x54]
push edx
call fcn.00453124
add esp, 8
mov ebx, eax
test eax, eax
jne 0x45a3af
lea ebx, [ebp - 0x54]
jmp 0x45a3b0
inc ebx
call fcn.0045a30c
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x45a42d
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4650a4
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00452eec
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4650a7
push ebx
call sub.KERNEL32.dll_WriteFile
jmp 0x45a42d
cmp dword [0x4650a0], 0xffffffff
je 0x45a42d
mov eax, dword [0x4650a0]
test eax, eax
je 0x45a42d
cmp byte [eax], 0
je 0x45a42d
push esi
push eax
call fcn.0045a4bc
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45bad0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x1c]
call fcn.0045b8ac
mov ebx, eax
test eax, eax
jne 0x45baf4
call fcn.0045a0a8
mov dword [eax], 8
or eax, 0xffffffff
jmp 0x45bb48
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 4]
mov dword [ebx + 4], edx
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x14], ecx
push eax
mov edx, dword [ebp + 0x18]
push edx
push ebx
push 0x45ba40
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 0x14]
push eax
call sub.KERNEL32.dll_CreateThread
test eax, eax
jne 0x45bb3c
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x718
jne 0x45bb35
push 0x59
call fcn.00458470
pop ecx
jmp 0x45bb48
call fcn.004584dc
jmp 0x45bb48
mov dword [ebx + 8], eax
test esi, esi
je 0x45bb48
mov edx, dword [ebp - 4]
mov dword [esi], edx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x40b9c5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x40ba0f
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x40b9de
jmp 0x40ba0f
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x40b9ff
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x40c932
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40c967
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40c991
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40c991
test edi, edi
je 0x40c95e
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40c95e
test edi, edi
je 0x40c999
mov eax, edi
jmp 0x40c960
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40c960
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_autoland_w32_d_000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.004104d7
add esp, 0xc
int3
Function at 0x41050b
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestEnumSet.exe_gMozillaPoisonSize], eax
call fcn.0040c932
pop ecx
mov ecx, dword [sym.TestEnumSet.exe_gMozillaPoisonSize]
mov dword [sym.TestEnumSet.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x410543
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestEnumSet.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x412c50
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444778
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x454100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x5c], edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x60], edi
mov dword [edi + 0x24], 0
mov dword [edi], vtable.std::_Func_impl_no_alloc_class__lambda_c3e2633a9e6ab5ca1b369db81b6871b5___void__struct_HookParam_const___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__.0
mov dword [edi + 0x24], edi
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x2c], eax
lea eax, [ebp - 0x40]
push ebx
push eax
mov dword [ebp - 4], 0
call fcn.0041af20
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push str.EMBED_SHARED_MEM
push eax
call fcn.004116e0
add esp, 0x14
cmp dword [eax + 0x14], 7
jbe 0x412ccb
mov eax, dword [eax]
push eax
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [edi + 0x30], eax
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
cmp ecx, 7
jbe 0x412d17
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x412d0d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412e19
push ecx
push edx
call fcn.0041f75c
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov ecx, dword [ebp - 0x2c]
mov byte [ebp - 4], 3
cmp ecx, 7
jbe 0x412d69
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x412d5f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412e19
push ecx
push edx
call fcn.0041f75c
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x58]
push ebx
push eax
mov dword [ebp - 0x2c], 7
call fcn.0041af20
add esp, 8
push 0
sub esp, 0x18
mov byte [ebp - 4], 4
mov edx, esp
push eax
push str.LUNA_VNR_HOOKMAN_
push edx
call fcn.004116e0
add esp, 0xc
lea ecx, [edi + 0x34]
call fcn.00412e30
mov ecx, dword [ebp - 0x44]
cmp ecx, 7
jbe 0x412de2
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x412dd8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412e1e
push ecx
push edx
call fcn.0041f75c
add esp, 8
push 0xa00
push 0
push 0
push 6
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 0x28], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041fbbb
mov esp, ebp
pop ebp
ret 8
call fcn.0042466f
call fcn.0042466f
int3
Function at 0x415790
Capabilities:
Create thread
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444acd
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x454100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4560f0
mov dword [ebp - 0x24], 0x4560f0
mov byte [ebp - 0x20], 0
call fcn.0041f1ef
add esp, 4
test eax, eax
jne 0x4158d0
cmp dword [0x45611c], 0x7fffffff
je 0x4158d7
mov byte [ebp - 0x20], 1
mov dword [ebp - 0x1c], 0x4560d0
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebp + 9]
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x4560d0
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00411ed0
mov eax, dword [eax + 4]
test eax, eax
je 0x4158b3
cmp eax, dword [0x4560d4]
je 0x4158b3
lea eax, [ebp + 8]
mov ecx, 0x4560d0
push eax
call fcn.00419700
push 8
mov esi, eax
call fcn.0041f72c
add esp, 4
test eax, eax
je 0x415872
mov dword [eax], esi
mov dword [eax + 4], 5
jmp 0x415874
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
push ecx
push 0
push eax
push 0x412120
push 0
push 0
call fcn.0042e4a5
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4158ef
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x4158e8
push ecx
push eax
call fcn.0041cf6f
add esp, 8
test eax, eax
jne 0x4158e8
push 0x4560f0
call fcn.0041f200
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
push 5
call fcn.0041d242
push 6
mov dword [0x45611c], 0x7ffffffe
call fcn.0041d242
push 1
call fcn.0041d242
push 6
mov dword [ebp - 0x14], 0
call fcn.0041d242
int3
Function at 0x416ec0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444d5c
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x454100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
mov dword [ebp - 4], 0
call fcn.00414f90
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
je 0x416f96
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.0041af20
add esp, 8
push 0
sub esp, 0x18
mov byte [ebp - 4], 1
mov ecx, esp
push eax
push str.LUNA_VNR_HOOKMAN_
push ecx
call fcn.004116e0
add esp, 0xc
lea ecx, [ebp - 0x30]
call fcn.00412e30
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 2
test eax, eax
je 0x416f50
cmp eax, 0xffffffff
je 0x416f50
push eax
call dword [0x446a80]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00404af0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x416fd3
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x10
movups xmmword [ecx], xmm0
push str.already_injected
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0040b500
call fcn.00414de0
add esp, 0x18
mov ecx, dword [ebp + 0x20]
cmp ecx, 7
jbe 0x417070
mov edx, dword [ebp + 0xc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x417066
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41708a
jmp 0x417066
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], esi
push eax
lea ecx, [ebp - 0x28]
call fcn.0040bda0
push 0x1c
mov byte [ebp - 4], 3
call fcn.0041f72c
mov esi, eax
add esp, 4
mov dword [ebp - 0x38], esi
mov byte [ebp - 4], 4
test esi, esi
je 0x417010
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov dword [esi], ecx
lea ecx, [esi + 4]
push eax
call fcn.0040bda0
jmp 0x417012
xor esi, esi
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 5
push eax
push 0
push esi
push 0x4121a0
push 0
push 0
call fcn.0042e4a5
add esp, 0x18
mov dword [ebp - 0x34], eax
test eax, eax
je 0x417096
mov ecx, dword [ebp - 0x30]
mov byte [ebp - 4], 6
test ecx, ecx
je 0x41708f
push ecx
push eax
call fcn.0041cf6f
add esp, 8
test eax, eax
jne 0x41708f
xorps xmm0, xmm0
lea ecx, [ebp - 0x2c]
movlpd qword [ebp - 0x34], xmm0
call fcn.00412ee0
jmp 0x416f96
push ecx
push edx
call fcn.0041f75c
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041fbbb
mov esp, ebp
pop ebp
ret
call fcn.0042466f
push 1
call fcn.0041d242
push 6
mov dword [ebp - 0x30], 0
call fcn.0041d242
int3
Function at 0x4173e0
Capabilities:
Create thread
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444e2d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x454100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4560f0
mov dword [ebp - 0x2c], 0x4560f0
mov byte [ebp - 0x28], 0
call fcn.0041f1ef
add esp, 4
test eax, eax
jne 0x41754a
cmp dword [0x45611c], 0x7fffffff
je 0x417551
mov byte [ebp - 0x28], 1
mov dword [ebp - 0x24], 0x4560d0
mov dword [ebp - 4], eax
movzx eax, byte [ebp + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebp + 9]
xor ecx, eax
movzx eax, byte [ebp + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, 0x4560d0
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00411ed0
mov eax, dword [eax + 4]
test eax, eax
je 0x41752e
cmp eax, dword [0x4560d4]
je 0x41752e
lea eax, [ebp + 8]
mov ecx, 0x4560d0
push eax
call fcn.00419700
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
movups xmm0, xmmword [ebp - 0x20]
push 0x18
mov dword [ebp - 0x44], eax
movups xmmword [ebp - 0x3c], xmm0
call fcn.0041f72c
add esp, 4
test eax, eax
je 0x4174ed
movups xmm0, xmmword [ebp - 0x44]
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x34]
movq qword [eax + 0x10], xmm0
jmp 0x4174ef
xor eax, eax
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
push ecx
push 0
push eax
push 0x412160
push 0
push 0
call fcn.0042e4a5
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x417569
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x417562
push ecx
push eax
call fcn.0041cf6f
add esp, 8
test eax, eax
jne 0x417562
push 0x4560f0
call fcn.0041f200
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 5
call fcn.0041d242
push 6
mov dword [0x45611c], 0x7ffffffe
call fcn.0041d242
push 1
call fcn.0041d242
push 6
mov dword [ebp - 0x14], 0
call fcn.0041d242
int3
Function at 0x433005
Capabilities:
Encode data using xor

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x719c2392
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x4a4211cd
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4076c4
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x42600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor edi, edi
mov dword [ebp - 0x210], ecx
lea eax, [ebp - 0x20c]
mov esi, edx
push edi
push eax
call fcn.004095f0
add esp, 0xc
lea ecx, [ebp - 0x20c]
call fcn.004072b0
lea eax, [ebp - 0x20c]
push eax
push edi
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ebx, eax
test ebx, ebx
jne 0x407756
push ecx
push str.ReadSharedMemory__:
push ecx
mov edi, 0x82
mov ecx, esi
mov edx, edi
call fcn.00403b0e
lea ecx, [esi + 0x208]
mov edx, edi
push ecx
push str.Could_not_open_file_mapping_object.
push ecx
call fcn.00403b0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x410], eax
xor eax, eax
jmp 0x407820
push 0x1e78
push edi
push edi
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x4077aa
push ecx
push str.ReadSharedMemory__:
push ecx
mov edi, 0x82
mov ecx, esi
mov edx, edi
call fcn.00403b0e
lea ecx, [esi + 0x208]
mov edx, edi
push ecx
push str.Could_not_map_view_of_file.
push ecx
call fcn.00403b0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
mov dword [esi + 0x410], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40774f
mov eax, dword [ebp - 0x210]
test eax, eax
jne 0x4077c6
call fcn.0040d306
mov dword [eax], 0x16
call fcn.0040d23a
jmp 0x4077d5
push 0x1034
push edi
push eax
call fcn.00408e00
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
push str.ReadSharedMemory__:
push ecx
mov edx, 0x82
mov ecx, esi
call fcn.00403b0e
lea eax, [ebp - 0x20c]
push eax
push str.succeeded._mapping_obj_name:__s
lea eax, [esi + 0x208]
push 0x104
push eax
call fcn.00406b11
and dword [esi + 0x410], 0
xor eax, eax
add esp, 0x10
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407989
leave
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x10003a40
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb0
push esi
push edi
push 0xa0
xor esi, esi
lea eax, [esp + 0x1c]
push esi
push eax
call sub.ntdll.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [esp + 0x18], eax
mov eax, 0x1000
mov word [esp + 0xb0], ax
lea eax, [esp + 0xc]
mov dword [esp + 0x44], eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x4c], 0xc
call dword [sym.imp.KERNEL32.dll_GetNextVDMCommand]
test eax, eax
je 0x10003ad9
push dword [esp + 0xc]
push esi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10003ad9
lea eax, [esp + 8]
push eax
movzx eax, word [ebp + 0xc]
push esi
push eax
push dword [esp + 0x20]
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test eax, eax
je 0x10003ad2
push eax
inc esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x402274
Capabilities:
Clear file content
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x400
push esi
push edi
xor esi, esi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, 0x58ce99d
jg 0x402298
inc edi
cmp edi, 0x1f6502b0
jl 0x402280
cmp dword [0x2be260c], 0x400
jne 0x4022e5
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push str.teyikekosigokifaruwoxuhaked
push esi
call fcn.004026f8
push esi
push esi
push esi
call fcn.004026c8
push esi
push esi
call fcn.004024e5
push esi
call fcn.0040284e
push esi
call fcn.0040285d
add esp, 0x24
xor edi, edi
cmp edi, 0xd0fe
jge 0x4022f6
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
cmp edi, 0x3a37ee
jg 0x40231d
inc edi
cmp edi, 0xe52f
jl 0x4022e7
mov eax, dword [0x423eb4]
mov dword [0x2be260c], eax
call fcn.00402026
mov edi, 0x3078f
cmp dword [0x2be260c], 0x51f
jne 0x402349
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec edi
jne 0x402331
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10

Function at 0x40734e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x423b80]
jne 0x407358
repz ret
jmp fcn.0040958c