joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b2d3
Capabilities:
Access peb ldr_data
Resolve function by hash

Disassembly:
push edi
push esi
cld
mov edx, dword fs:[0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x42b2f4
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x42b2eb
cmp edi, 0x6a4abc5b
mov eax, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x42b2e3
pop esi
pop edi
ret

Function at 0x42b352
Capabilities:
Resolve function by hash

Disassembly:
push dword [esp + 8]
push 0xec0e4e8e
push dword [esp + 0xc]
call fcn.0042b380
call eax
ret 8

Function at 0x42b380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov esi, dword [eax + 0x3c]
mov esi, dword [esi + eax + 0x78]
add esi, eax
push esi
mov esi, dword [esi + 0x20]
add esi, eax
xor ecx, ecx
dec ecx
inc ecx
lodsd eax, dword [esi]
add eax, dword [ebp + 8]
xor ebx, ebx
movzx edx, byte [eax]
cmp dl, dh
je 0x42b3b0
ror ebx, 0xd
add ebx, edx
inc eax
jmp 0x42b3a1
cmp ebx, dword [ebp + 0xc]
jne 0x42b39a
mov edx, dword [ebp + 8]
pop esi
mov ebx, dword [esi + 0x24]
add ebx, edx
mov cx, word [ebx + ecx*2]
mov ebx, dword [esi + 0x1c]
add ebx, edx
mov eax, dword [ebx + ecx*4]
add eax, edx
pop esi
pop ebx
leave
ret 8
Function at 0x42b4ac
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 0xc]
mov cl, byte [eax]
add cl, 0x30
mov byte [ebp - 0x18], cl
mov cl, byte [eax + 2]
mov al, byte [eax + 6]
push ebx
push esi
mov byte [ebp - 0x17], cl
mov ecx, dword [ebp + 0x10]
push edi
and ecx, 0xfffffffe
push 2
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0x16], al
mov byte [ebp - 0x15], 0
lea eax, [ebp - 0x18]
pop ecx
xor dword [eax], 0xd6d7a4b1
add eax, 4
dec ecx
jne 0x42b4df
push 0xf0000040
xor ebx, ebx
inc ebx
push ebx
xor esi, esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 1], cl
push 0x43c28bf0
push dword [ebp + 0x14]
call fcn.0042b380
call eax
test eax, eax
je 0x42b5ae
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x8003
push dword [ebp - 0x10]
push 0x4105a130
push dword [ebp + 0x14]
call fcn.0042b380
call eax
push 0x10
pop edi
cmp eax, ebx
jne 0x42b595
push esi
push 8
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], edi
push 0xc2122629
push dword [ebp + 0x14]
call fcn.0042b380
call eax
cmp eax, ebx
jne 0x42b583
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x28]
push eax
push 2
push dword [ebp - 8]
push 0xc7afb4a9
push dword [ebp + 0x14]
call fcn.0042b380
call eax
cmp eax, ebx
jne 0x42b583
cmp dword [ebp - 0xc], edi
jne 0x42b583
mov byte [ebp - 1], bl
push dword [ebp - 8]
push 0x25d4ae7a
push dword [ebp + 0x14]
call fcn.0042b380
call eax
push esi
push dword [ebp - 0x10]
push 0x5ae8e894
push dword [ebp + 0x14]
call fcn.0042b380
call eax
cmp byte [ebp - 1], 0
jne 0x42b5b5
xor al, al
jmp 0x42b649
xor bl, bl
lea edx, [ebp - 0x28]
mov cl, byte [edx]
mov al, cl
and al, 0xf
shr cl, 4
add al, cl
add al, 0x61
cmp al, 0x7a
ja 0x42b5d6
mov esi, dword [ebp + 8]
movzx ecx, bl
mov byte [esi + ecx], al
inc bl
inc edx
dec edi
jne 0x42b5ba
mov esi, dword [ebp + 8]
movzx eax, bl
mov byte [esi + eax], 0x2e
mov eax, dword [ebp + 0x10]
push 5
xor edx, edx
pop edi
div edi
inc bl
movzx ecx, bl
add ecx, esi
add bl, 3
test edx, edx
jne 0x42b604
mov dword [ecx], 0x7a6962
jmp 0x42b640
mov eax, dword [ebp + 0x10]
test al, 3
jne 0x42b615
mov dword [ecx], 0x6f666e69
inc bl
jmp 0x42b640
push 3
xor edx, edx
pop edi
div edi
test edx, edx
jne 0x42b628
mov dword [ecx], 0x67726f
jmp 0x42b640
mov al, byte [ebp + 0x10]
and al, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0xfff909f5
add eax, 0x74656e
mov dword [ecx], eax
movzx eax, bl
mov byte [esi + eax], 0
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x5f9613
Capabilities:
Encode data using xor

Disassembly:
out 0x81, al
or dl, ch
pushal
mov ecx, 0x94e0b064
mov ch, 0xb5
add ch, byte [esi - 0x37]
pop eax
mov ah, 0xc
out dx, eax
xor esi, dword [edx]
invalid

Function at 0x770633
Capabilities:
Encode data using xor

Disassembly:
invalid
movsb byte es:[edi], byte [esi]
loop 0x7705e7
test eax, 0x16a7013a
invalid
in al, dx
rol dword [esi - 0x28], cl
mov bl, 0xa1
ja 0x77069c
jge 0x7705ed
pushfd
push ecx
mov bx, 0xabad
mov eax, dword [esi - 0x52bdce63]
not dword [ecx - 0x79]
rcr ebp, 0xd8
insd dword es:[edi], dx
push ds
and dword ss:[edx], ebp
xor dword [ebx + 0x13], ebx
div dword [ecx + 0x4d1744be]
inc edi
push ebp
dec edx
add dword [ebx - 0x5c7e6de1], ebx
jae 0x7706a8
inc ecx
call 0xe23beaa1
mov ch, 0xd3
out 0x52, al
push eax
imul esp, dword [edi], 0x6437544a
push esi
jo 0x7706ac
add al, 0xa0
push es
daa
add byte [edi - 0x786c897b], 0x96
mov byte [0xe4bee910], al
lahf
pop ecx
sbb byte [edi + 0x3f396cc2], ch
scasd eax, dword es:[edi]
ret 0xd3cc
lodsb al, byte [esi]
ficom dword [ebx + 0x79b50e68]
jecxz 0x7706c9
scasb al, byte es:[edi]
scasb al, byte es:[edi]
sub eax, 0x7c71f75f
pop edi
div dword [ecx + 0x7c]
xchg byte [ebx], bl
cld
ja 0x770721
push dword [ecx]
sub byte [esi], dh
add ah, byte [edx - 0x5d]
lahf
add dword [edi - 0x69], esp
cmp eax, 0x2b98f23d
xor esi, dword [ebx - 0x1fcc7f]
xchg esi, eax
jne 0x7706e9
add ebx, 0xffffffd6
xchg ecx, eax
mov dword [eax], 0x6273117
pop ebx
adc byte [eax + 0x7d], al
mov ah, 0x79
pop es
int1
sub esi, dword [ecx]
mov bh, 0xac
invalid
mov eax, dword [edx]
out 0xc3, eax
or byte [ebp - 0x17c2d470], ch
lds esp, [ecx]
pop ss
loope 0x7706ff
xor eax, 0x94c87bd
and ebp, esp
test dword [ebx - 0x51], esi
in eax, 0x85
je 0x7706a6
scasd eax, dword es:[edi]
mov bh, 0xd3
mov dword [0xa4f1b6f3], eax
div byte [edi]
sar dword [ebx - 0x77], 0x33
push esi
add byte [0x640d012b], 0xcf
clc
xor ebx, dword [ecx - 0x79]
js 0x770737
stosd dword es:[edi], eax
dec ebx
test dword [ecx + ebx - 0x13], ebx
pop esp
sbb ebp, ebp
mov edx, 0x56f321ff
push esi
jb 0x770723
mov edi, 0x976e4da1
aas
add dword [edx - 0x2d6f9a89], ebx
test eax, 0xd1c96251
nop
shr byte [ecx - 0x2e369daf], cl
test byte [edi + 0x3e], ch
sbb eax, 0x97837791
or bh, byte [ecx - 0x7e0f6020]
pop es
xor al, 0x19
or eax, 0xdb6c2b1c
inc ebx
push edi
adc byte [ebx], bl
movsd dword es:[edi], dword [esi]
mov dh, 0xe9
mov eax, esp
mov edx, dword [eax - 0x77]
pop ebx
push ss
cmc
popfd
mov ah, 0x50
push edi
xor dword [ebx - 0x55c3366f], ecx
lodsb al, byte [esi]
test eax, 0x2731751c
sbb dword [ebp + ebx*8 + 7], edx
and dl, byte [esi + ecx + 0x5a72a342]
mul byte [ecx - 0x5b]
mov ecx, 0x91546ee7
jl 0x77072a
stc
test dl, dh
mov ebp, 0x324481ff
invalid
Function at 0x401de3
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
call 0x401dec
pop eax
mov esi, dword fs:[0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0x1c]
push esi
mov ebx, dword [esi + 8]
cmp eax, ebx
jb 0x401e0f
mov ecx, dword [esi + 0x10]
add ecx, ebx
cmp eax, ecx
ja 0x401e0f
mov eax, ebx
jmp 0x401e24
mov esi, dword [esi]
mov ebx, dword [esi]
cmp ebx, dword [esp]
jne 0x401dfb
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
pop esi
pop esi
leave
ret
Function at 0x403290
Capabilities:
Enumerate gui resources
Get hostname

Disassembly:
mov eax, 0x1c0c
call fcn.0040d330
mov eax, dword [0xa384f4]
mov ecx, dword [0xa38464]
shr eax, 3
test eax, eax
jbe 0x4033c2
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jmp 0x4032e0
cmp dword [0xa384f4], 0x959
jne 0x4033a4
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push 0
call edi
push 0
lea ecx, [esp + 0x820]
push ecx
push 0
call ebx
push 0
push 0
call esi
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
lea edx, [esp + 0x1024]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea eax, [esp + 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x1420]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0x402cc8
push 0x402ce4
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov eax, dword [esp + 0x10]
push eax
call fcn.00403090
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x4032e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c0c
ret
Function at 0x403c50
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x1430
call fcn.0040d330
cmp dword [0xa384f4], 0xc
push ebx
push ebp
push esi
push edi
jne 0x403d1c
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
lea eax, [esp + 0xc44]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
push 0
push 0
lea ecx, [esp + 0x848]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push 0
push 0x402d6c
push 0x402d78
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
push 0
lea edx, [esp + 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0x402d98
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push 0
lea eax, [esp + 0x444]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSize]
push 0x402de0
call dword [sym.imp.KERNEL32.dll_AddAtomA]
push 0
push 0
call fcn.00403dd3
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.00403faa
fstp st(0)
add esp, 8
mov edi, dword [sym.imp.USER32.dll_SetCaretPos]
mov ebx, dword [sym.imp.USER32.dll_CharLowerBuffW]
mov ebp, dword [sym.imp.USER32.dll_GetSysColorBrush]
xor esi, esi
cmp esi, 0x9458
jge 0x403d4e
push 0
push 0
call edi
push 0
lea ecx, [esp + 0xc44]
push ecx
call ebx
push 0
call ebp
inc esi
cmp esi, 0x14ee8
jl 0x403d30
mov edx, dword [0x42b6a4]
mov eax, dword [0x42b678]
mov dword [0xa384f4], edx
mov dword [0xa39dfc], eax
call fcn.004034d0
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4086e6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42aaa8]
jne 0x4086f0
repz ret
jmp fcn.0040a459
Function at 0x409b80
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004049e0
and dword [ebp - 4], 0
cmp dword [0x42bf6c], 0
mov ebx, eax
jne 0x409c31
push 0x4023c8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409ce2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4023bc
push edi
call esi
test eax, eax
je 0x409ce2
push eax
call fcn.0040496e
mov dword [esp], 0x4023ac
push edi
mov dword [0x42bf6c], eax
call esi
push eax
call fcn.0040496e
mov dword [esp], 0x402398
push edi
mov dword [0x42bf70], eax
call esi
push eax
call fcn.0040496e
mov dword [esp], 0x40237c
push edi
mov dword [0x42bf74], eax
call esi
push eax
call fcn.0040496e
pop ecx
mov dword [0x42bf7c], eax
test eax, eax
je 0x409c31
push 0x402364
push edi
call esi
push eax
call fcn.0040496e
pop ecx
mov dword [0x42bf78], eax
mov eax, dword [0x42bf78]
cmp eax, ebx
je 0x409c89
cmp dword [0x42bf7c], ebx
je 0x409c89
push eax
call fcn.004049e9
push dword [0x42bf7c]
mov esi, eax
call fcn.004049e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409c89
test edi, edi
je 0x409c89
call esi
test eax, eax
je 0x409c80
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409c80
test byte [ebp - 0xc], 1
jne 0x409c89
or dword [ebp + 0x10], 0x200000
jmp 0x409cc2
mov eax, dword [0x42bf70]
cmp eax, ebx
je 0x409cc2
push eax
call fcn.004049e9
pop ecx
test eax, eax
je 0x409cc2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409cc2
mov eax, dword [0x42bf74]
cmp eax, ebx
je 0x409cc2
push eax
call fcn.004049e9
pop ecx
test eax, eax
je 0x409cc2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42bf6c]
call fcn.004049e9
pop ecx
test eax, eax
je 0x409ce2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409ce4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40888c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41dba0]
jne 0x408896
repz ret
jmp fcn.0040e9fc

Function at 0x40e32d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41dba0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040500e
and dword [ebp - 0x14], 0
cmp dword [0x44c340], 0
mov dword [ebp - 0x18], eax
jne 0x40e3e0
push 0x402bb8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40e488
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402bac
push ebx
call edi
test eax, eax
je 0x40e488
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402b9c
push ebx
mov dword [0x44c340], eax
call edi
push eax
call esi
push 0x402b88
push ebx
mov dword [0x44c344], eax
call edi
push eax
call esi
push 0x402b6c
push ebx
mov dword [0x44c348], eax
call edi
push eax
call esi
mov dword [0x44c350], eax
test eax, eax
je 0x40e3e0
push 0x402b54
push ebx
call edi
push eax
call esi
mov dword [0x44c34c], eax
mov eax, dword [0x44c34c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40e439
cmp dword [0x44c350], ecx
je 0x40e439
push eax
call esi
push dword [0x44c350]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40e439
test ebx, ebx
je 0x40e439
call edi
test eax, eax
je 0x40e430
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40e430
test byte [ebp - 8], 1
jne 0x40e439
or dword [ebp + 0x10], 0x200000
jmp 0x40e46c
mov eax, dword [0x44c344]
cmp eax, dword [ebp - 0x18]
je 0x40e46c
push eax
call esi
test eax, eax
je 0x40e46c
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40e46c
mov eax, dword [0x44c348]
cmp eax, dword [ebp - 0x18]
je 0x40e46c
push eax
call esi
test eax, eax
je 0x40e46c
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44c340]
call esi
test eax, eax
je 0x40e488
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40e48a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040888c
leave
ret
Function at 0x41b230
Capabilities:
Delete file
Get uefi variable

Disassembly:
sub esp, 0xc2c
cmp dword [0x2b75ea4], 0x37
jne 0x41b2a6
push 0x4035d8
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleSelectionInfo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0x4035e8
push 0x403614
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
lea edx, [esp]
push edx
push 0
lea eax, [esp + 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
lea ecx, [esp + 0x42c]
push ecx
push 0x403640
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov edx, dword [0x2b762b8]
mov ecx, dword [0x2b75988]
mov al, byte [edx + esi + 0x38d6]
mov byte [ecx + esi], al
add esp, 0xc2c
ret
Function at 0x4931fa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b9510]
jne 0x493204
repz ret
jmp fcn.0049794f

Function at 0x4a05ac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4b9510]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004994eb
and dword [ebp - 0x14], 0
cmp dword [0x4bf1b8], 0
mov dword [ebp - 0x18], eax
jne 0x4a065f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4a0707
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4a0707
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4bf1b8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4bf1bc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4bf1c0], eax
call edi
push eax
call esi
mov dword [0x4bf1c8], eax
test eax, eax
je 0x4a065f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4bf1c4], eax
mov eax, dword [0x4bf1c4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4a06b8
cmp dword [0x4bf1c8], ecx
je 0x4a06b8
push eax
call esi
push dword [0x4bf1c8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4a06b8
test ebx, ebx
je 0x4a06b8
call edi
test eax, eax
je 0x4a06af
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4a06af
test byte [ebp - 8], 1
jne 0x4a06b8
or dword [ebp + 0x10], 0x200000
jmp 0x4a06eb
mov eax, dword [0x4bf1bc]
cmp eax, dword [ebp - 0x18]
je 0x4a06eb
push eax
call esi
test eax, eax
je 0x4a06eb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4a06eb
mov eax, dword [0x4bf1c0]
cmp eax, dword [ebp - 0x18]
je 0x4a06eb
push eax
call esi
test eax, eax
je 0x4a06eb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4bf1b8]
call esi
test eax, eax
je 0x4a0707
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4a0709
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004931fa
leave
ret

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x403630
Capabilities:
Get disk information

Disassembly:
sub esp, 0x430
mov eax, dword [esp + 0x434]
mov ecx, dword [eax]
push ebx
mov ebx, dword [0x4465bc]
push ebp
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [0x4465b8]
xor ebp, ebp
lea eax, [esp + 0x14]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x38], 0x9e3779b9
call fcn.00403600
mov eax, dword [0x4465c0]
mov edx, dword [0x4465c4]
add dword [esp + 0x14], 0x23f
mov dword [esp + 0x3c], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], 0x20
mov dword [esp + 0x24], 2
add dword [esp + 0x24], 3
mov eax, dword [0x2af463c]
shl ecx, 4
add ecx, dword [esp + 0x3c]
mov dword [esp + 0x10], ecx
cmp eax, 0xfa9
jne 0x4036c0
mov dword [0x2af4638], 0xedeb2e40
jmp 0x4036cd
cmp eax, 0x3eb
jne 0x4036cd
mov dword [0x2af1544], ebp
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
shr eax, 5
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x18]
mov dword [0x2af4634], 0xf4ea3dee
call fcn.00403610
mov eax, dword [esp + 0x20]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
xor dword [esp + 0x18], eax
cmp dword [0x2af463c], 0x213
jne 0x403748
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
sub esi, dword [esp + 0x18]
lea ecx, [esp + 0x10]
mov eax, esi
mov dword [esp + 0x34], esi
call fcn.004035f0
add dword [esp + 0x10], edi
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x14]
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
nop
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
mov ecx, esi
shr ecx, 5
add ecx, ebx
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x20]
xor dword [esp + 0x10], eax
cmp dword [0x2af463c], 0x121
jne 0x4037a8
push ebp
push ebp
lea edx, [esp + 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
mov ecx, dword [esp + 0x10]
xor ecx, dword [esp + 0x18]
lea eax, [esp + 0x28]
mov dword [esp + 0x10], ecx
call fcn.00403620
mov eax, dword [esp + 0x38]
sub dword [esp + 0x14], eax
sub dword [esp + 0x2c], 1
mov ecx, dword [esp + 0x28]
jne 0x403690
mov eax, dword [esp + 0x444]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
add esp, 0x430
ret 4
Function at 0x407671
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x445800]
jne 0x40767b
repz ret
jmp fcn.0040e1bc

Function at 0x410733
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040bc6a
and dword [ebp - 4], 0
cmp dword [0x449cb8], 0
mov ebx, eax
jne 0x4107e4
push 0x402c3c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x410895
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402c30
push edi
call esi
test eax, eax
je 0x410895
push eax
call fcn.0040bbf8
mov dword [esp], 0x402c20
push edi
mov dword [0x449cb8], eax
call esi
push eax
call fcn.0040bbf8
mov dword [esp], 0x402c0c
push edi
mov dword [0x449cbc], eax
call esi
push eax
call fcn.0040bbf8
mov dword [esp], 0x402bf0
push edi
mov dword [0x449cc0], eax
call esi
push eax
call fcn.0040bbf8
pop ecx
mov dword [0x449cc8], eax
test eax, eax
je 0x4107e4
push 0x402bd8
push edi
call esi
push eax
call fcn.0040bbf8
pop ecx
mov dword [0x449cc4], eax
mov eax, dword [0x449cc4]
cmp eax, ebx
je 0x41083c
cmp dword [0x449cc8], ebx
je 0x41083c
push eax
call fcn.0040bc73
push dword [0x449cc8]
mov esi, eax
call fcn.0040bc73
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41083c
test edi, edi
je 0x41083c
call esi
test eax, eax
je 0x410833
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x410833
test byte [ebp - 0xc], 1
jne 0x41083c
or dword [ebp + 0x10], 0x200000
jmp 0x410875
mov eax, dword [0x449cbc]
cmp eax, ebx
je 0x410875
push eax
call fcn.0040bc73
pop ecx
test eax, eax
je 0x410875
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x410875
mov eax, dword [0x449cc0]
cmp eax, ebx
je 0x410875
push eax
call fcn.0040bc73
pop ecx
test eax, eax
je 0x410875
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x449cb8]
call fcn.0040bc73
pop ecx
test eax, eax
je 0x410895
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x410897
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret