joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x9c
mov eax, dword [esp + 0xbc]
mov edx, dword [esp + 0xc0]
mov esi, dword [esp + 0xb0]
mov ebx, dword [esp + 0xb4]
mov dword [esp + 0x3c], eax
lea eax, [edx + 0x6c]
mov edi, dword [esp + 0xb8]
mov dword [esp], eax
call method.std::__timepunct_wchar_t__const_std::use_facet_std.__timepunct_wchar_t____std::locale_const_
mov edx, dword [esp + 0xc0]
mov dword [esp + 0x54], 0
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x48]
mov dword [esp + 0x58], ecx
mov ecx, dword [eax + 0x4c]
mov dword [esp + 0x5c], ecx
mov ecx, dword [eax + 0x50]
mov dword [esp + 0x60], ecx
mov ecx, dword [eax + 0x54]
mov dword [esp + 0x64], ecx
mov ecx, dword [eax + 0x58]
mov dword [esp + 0x68], ecx
mov ecx, dword [eax + 0x5c]
mov dword [esp + 0x6c], ecx
mov ecx, dword [eax + 0x60]
mov dword [esp + 0x70], ecx
mov ecx, dword [eax + 0x2c]
mov dword [esp + 0x74], ecx
mov ecx, dword [eax + 0x30]
mov dword [esp + 0x78], ecx
mov ecx, dword [eax + 0x34]
mov dword [esp + 0x7c], ecx
mov ecx, dword [eax + 0x38]
mov dword [esp + 0x80], ecx
mov ecx, dword [eax + 0x3c]
mov dword [esp + 0x84], ecx
mov ecx, dword [eax + 0x40]
mov eax, dword [eax + 0x44]
mov dword [esp + 0x88], ecx
mov ecx, ebp
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x54]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], esi
mov dword [esp + 4], ebx
xor bx, bx
mov dword [esp + 0x18], 7
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
call sym.__ZNKSt8time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE24_M_extract_wday_or_monthES3_S3_RiPPKwjRSt8ios_baseRSt12_Ios_I
sub esp, 0x24
mov ecx, eax
movzx esi, dx
mov eax, edx
mov dword [esp + 0x4c], edx
mov edx, ebx
mov ebx, dword [esp + 0x54]
mov ebp, ecx
mov dword [esp + 0x48], ecx
or edx, esi
test ebx, ebx
jne 0x45b800
mov ebx, dword [esp + 0xc8]
mov esi, dword [esp + 0x50]
mov dword [ebx + 0x18], esi
cmp ax, 0xffff
sete bl
test ecx, ecx
setne al
and al, bl
mov esi, eax
jne 0x45b828
cmp word [esp + 0x3c], 0xffff
sete al
mov ecx, eax
test edi, edi
je 0x45b7e2
test al, al
jne 0x45b810
cmp bl, cl
jne 0x45b7f0
mov eax, dword [esp + 0xc4]
or dword [eax], 2
add esp, 0x9c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov esi, dword [esp + 0xc4]
or dword [esi], 4
jmp 0x45b7bd
mov eax, dword [edi + 8]
cmp eax, dword [edi + 0xc]
jae 0x45b850
movzx eax, word [eax]
cmp ax, 0xffff
sete cl
jmp 0x45b7e2
mov eax, dword [ecx + 8]
cmp eax, dword [ecx + 0xc]
jae 0x45b868
movzx eax, word [eax]
xor ebx, ebx
mov ebp, 0
cmp ax, 0xffff
cmove ebx, esi
cmovne ebp, ecx
jmp 0x45b7cf
mov eax, dword [edi]
mov dword [esp + 0x3c], edx
mov ecx, edi
call dword [eax + 0x24]
mov edx, dword [esp + 0x3c]
jmp 0x45b81b
mov eax, dword [ecx]
mov dword [esp + 0x44], edx
mov dword [esp + 0x40], ecx
call dword [eax + 0x24]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
jmp 0x45b833
Function at 0x4739b0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
jmp 0x4739d3
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
jne 0x4739f1
mov ecx, ebx
call method.std::__basic_file_char_.fd__
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sym._read
mov ebp, eax
cmp eax, 0xffffffff
je 0x4739c8
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x1000600e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001a030]
jne 0x10006018
repz ret
jmp fcn.10007176

Function at 0x1000ddab
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100072ee
and dword [ebp - 4], 0
cmp dword [0x1001be38], 0
mov ebx, eax
jne 0x1000de5c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000df0d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1000df0d
push eax
call fcn.1000727c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1001be38], eax
call esi
push eax
call fcn.1000727c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1001be3c], eax
call esi
push eax
call fcn.1000727c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1001be40], eax
call esi
push eax
call fcn.1000727c
pop ecx
mov dword [0x1001be48], eax
test eax, eax
je 0x1000de5c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000727c
pop ecx
mov dword [0x1001be44], eax
mov eax, dword [0x1001be44]
cmp eax, ebx
je 0x1000deb4
cmp dword [0x1001be48], ebx
je 0x1000deb4
push eax
call fcn.100072f7
push dword [0x1001be48]
mov esi, eax
call fcn.100072f7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1000deb4
test edi, edi
je 0x1000deb4
call esi
test eax, eax
je 0x1000deab
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000deab
test byte [ebp - 0xc], 1
jne 0x1000deb4
or dword [ebp + 0x10], 0x200000
jmp 0x1000deed
mov eax, dword [0x1001be3c]
cmp eax, ebx
je 0x1000deed
push eax
call fcn.100072f7
pop ecx
test eax, eax
je 0x1000deed
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1000deed
mov eax, dword [0x1001be40]
cmp eax, ebx
je 0x1000deed
push eax
call fcn.100072f7
pop ecx
test eax, eax
je 0x1000deed
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1001be38]
call fcn.100072f7
pop ecx
test eax, eax
je 0x1000df0d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000df0f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401290
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x96c
mov eax, dword [0x410004]
xor eax, esp
mov dword [esp + 0x968], eax
push ebx
push esi
push edi
lea eax, [esp + 0xc]
push eax
xor esi, esi
push 0x411a68
mov dword [esp + 0x24], esi
mov byte [esp + 0x14], 0x72
mov byte [esp + 0x15], 0x62
mov byte [esp + 0x16], 0
call fcn.004019b8
mov edi, eax
xor eax, eax
add esp, 8
mov word [esp + 0xc], ax
mov byte [esp + 0xe], al
cmp edi, esi
je 0x4012ff
push 2
push esi
push edi
call fcn.00401f21
push edi
call fcn.00401e29
push edi
mov esi, eax
call fcn.0040201d
add esp, 0x14
push esi
call fcn.00401765
lea ecx, [esp + 0x10]
push ecx
mov ebx, eax
push 0x411a68
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x18], 0x72
mov byte [esp + 0x19], 0x62
mov byte [esp + 0x1a], 0
call fcn.004019b8
mov edi, eax
xor eax, eax
add esp, 0xc
mov word [esp + 0xc], ax
mov byte [esp + 0xe], al
test edi, edi
je 0x401350
push edi
push 1
push esi
push ebx
call fcn.00401c6f
push edi
call fcn.0040201d
add esp, 0x14
lea eax, [esi + ebx]
mov dword [esp + 0xc], eax
cmp ebx, eax
jae 0x4014a4
mov ecx, 0x86
xor eax, eax
mov dl, byte [eax + 0x40e3e4]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [esp + eax + 0x27], dl
jns 0x401383
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x18
jl 0x401366
lea eax, [esp + 0x27]
mov byte [esp + 0x3f], 0
xor edx, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401397
sub eax, esi
add eax, 1
je 0x4013de
mov edi, ebx
lea eax, [esp + 0x27]
sub edi, eax
lea ecx, [ecx]
mov cl, byte [esp + edx + 0x27]
lea eax, [esp + edx + 0x27]
cmp cl, byte [edi + eax]
jne 0x401495
lea eax, [esp + 0x27]
inc edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4013d0
sub eax, esi
inc eax
cmp edx, eax
jb 0x4013b0
mov dword [esp + 0x1c], 1
mov ecx, 0x86
xor eax, eax
lea ecx, [ecx]
mov dl, byte [eax + 0x40e3e4]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [esp + eax + 0x27], dl
jns 0x40140d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x18
jl 0x4013f0
lea eax, [esp + 0x27]
mov byte [esp + 0x3f], 0
lea ecx, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401420
sub eax, ecx
lea ebx, [ebx + eax + 1]
lea eax, [esp + 0x40]
push eax
mov ecx, 0x24b
mov esi, ebx
lea edi, [esp + 0x44]
lea eax, [esp + 0x17]
rep movsd dword es:[edi], dword [esi]
mov byte [esp + 0x17], 0x49
mov byte [esp + 0x18], 0x4e
mov byte [esp + 0x19], 0x54
mov byte [esp + 0x1a], 0x20
mov byte [esp + 0x1b], 0x30
mov byte [esp + 0x1c], 0x78
mov byte [esp + 0x1d], 0x32
mov byte [esp + 0x1e], 0x45
mov byte [esp + 0x1f], dl
call section..text
add esp, 4
xor eax, eax
mov ecx, 0x24b
lea esi, [esp + 0x40]
mov edi, 0x411b70
mov dword [esp + 0x13], eax
mov dword [esp + 0x17], eax
mov byte [esp + 0x1b], al
rep movsd dword es:[edi], dword [esi]
inc ebx
cmp ebx, dword [esp + 0xc]
jb 0x40135f
mov ebx, dword [esp + 0x20]
push ebx
call fcn.00401688
mov ecx, dword [esp + 0x978]
mov eax, dword [esp + 0x20]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401679
mov esp, ebp
pop ebp
ret
Function at 0x4014d0
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push esi
push edi
push 0x40e400
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov eax, 0x411a68
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4014f3
push 4
push 0x3000
sub eax, edx
push eax
mov eax, dword [0x411a60]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
mov eax, 0x411a68
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401520
mov ecx, dword [0x411a60]
push 0
sub eax, edx
push eax
push 0x411a68
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [0x411a60]
push 0
push 0
push esi
push edi
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov eax, dword [0x411a60]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret

Function at 0x401570
Capabilities:
Get common file path
Resume thread
Set console window title
Suspend thread

Disassembly:
push ecx
push 0x104
push 0x411a68
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.00401290
test eax, eax
je 0x401675
push esi
push edi
push 0x411a68
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, 0x411a68
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4015b0
mov ax, word [0x40e420]
mov word [edi], ax
mov eax, 0x411b70
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4015c8
mov edi, 0x411a68
sub eax, ecx
mov esi, ecx
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4015e0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x411c74
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 0x411c9c
call fcn.0040182f
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
add esp, 4
push 0
push str.Valve001
call esi
test eax, eax
jne 0x401638
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call edi
push 0
push str.Valve001
call esi
test eax, eax
je 0x401627
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [esp + 8]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
mov dword [0x411a60], eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
call fcn.004014d0
mov eax, dword [0x411a60]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
xor eax, eax
pop ecx
ret

Function at 0x401679
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401683
repz ret
jmp fcn.0040221e
Function at 0x407406
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406455
and dword [ebp - 4], 0
cmp dword [0x41193c], 0
mov ebx, eax
jne 0x4074b7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407568
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407568
push eax
call fcn.004063e3
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41193c], eax
call esi
push eax
call fcn.004063e3
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x411940], eax
call esi
push eax
call fcn.004063e3
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x411944], eax
call esi
push eax
call fcn.004063e3
pop ecx
mov dword [0x41194c], eax
test eax, eax
je 0x4074b7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004063e3
pop ecx
mov dword [0x411948], eax
mov eax, dword [0x411948]
cmp eax, ebx
je 0x40750f
cmp dword [0x41194c], ebx
je 0x40750f
push eax
call fcn.0040645e
push dword [0x41194c]
mov esi, eax
call fcn.0040645e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40750f
test edi, edi
je 0x40750f
call esi
test eax, eax
je 0x407506
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407506
test byte [ebp - 0xc], 1
jne 0x40750f
or dword [ebp + 0x10], 0x200000
jmp 0x407548
mov eax, dword [0x411940]
cmp eax, ebx
je 0x407548
push eax
call fcn.0040645e
pop ecx
test eax, eax
je 0x407548
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407548
mov eax, dword [0x411944]
cmp eax, ebx
je 0x407548
push eax
call fcn.0040645e
pop ecx
test eax, eax
je 0x407548
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41193c]
call fcn.0040645e
pop ecx
test eax, eax
je 0x407568
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40756a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x5ca45cb8
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x7afc26f4
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x406400
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406466
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00404658
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040308c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x406450
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40646d
lea eax, [ebp - 0x10]
call fcn.004043e8
ret

Function at 0x40b788
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b7c1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004044d8
jmp 0x40b7ca
mov eax, ebx
mov edx, esi
call fcn.0040443c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b7d4
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b7f5
mov al, byte [esp]
jmp 0x40b7f7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40bfd8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40be40
mov eax, dword [0x46fa80]
cmp byte [eax], 0
je 0x40c054
mov eax, dword [0x46f864]
call fcn.00402ea0
call fcn.00402c74
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408e6c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40c09c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40c08a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x46f808]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x470668]
call fcn.0040586c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x421a90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
lea ebx, [ebp - 0xc]
mov esi, 0x470888
cmp byte [0x46c50c], 0
je 0x421ab3
push 0x47088c
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x421b9c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi], 0
jne 0x421b57
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edx, dword [0x470884]
mov dword [eax], edx
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, 0x46c510
mov ecx, 2
call fcn.00402d80
mov edx, 0x421a14
mov eax, dword [ebp - 8]
add eax, 5
call fcn.00421a34
mov edx, dword [ebp - 8]
mov dword [edx + 6], eax
mov eax, dword [ebp - 8]
add eax, 0xa
mov dword [ebx], eax
mov eax, dword [ebx]
mov byte [eax], 0xe8
mov eax, dword [ebp - 8]
lea edx, [eax + 4]
mov eax, dword [ebx]
call fcn.00421a34
mov edx, dword [ebx]
mov dword [edx + 1], eax
mov eax, dword [ebx]
mov edx, dword [esi]
mov dword [eax + 5], edx
mov eax, dword [ebx]
mov dword [esi], eax
add dword [ebx], 0xd
mov eax, dword [ebx]
sub eax, dword [ebp - 8]
cmp eax, 0xffc
jl 0x421b1e
mov eax, dword [ebp - 8]
mov dword [0x470884], eax
mov eax, dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [esi]
mov dword [ebx], eax
mov eax, dword [ebx]
mov eax, dword [eax + 5]
mov dword [esi], eax
mov eax, dword [ebx]
mov edx, dword [ebp + 8]
mov dword [eax + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 9], edx
inc dword [0x46c508]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x421ba3
cmp byte [0x46c50c], 0
je 0x421b9b
push 0x47088c
call sub.kernel32.dll_LeaveCriticalSection_1
ret

Function at 0x423194
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42319a
ret

Function at 0x425660
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4256b1
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x425698
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x425688
jmp 0x4256b1
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x425699
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e1cc
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404898
xor eax, eax
push ebp
push 0x42e2fa
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x42e2cd
xor eax, eax
push ebp
push 0x42e2c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004046a8
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42e29b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x42e28a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004046a8
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.004048a8
mov edx, ebx
pop ecx
call fcn.00402d80
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e291
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x46f7a4]
mov dl, 1
mov eax, dword [0x407798]
call fcn.0040c15c
call fcn.00403dfc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e301
lea eax, [ebp - 4]
call fcn.004043e8
ret
Function at 0x42e308
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42e4b9
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404a98
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x42e4d0
call fcn.004046f4
mov eax, ebx
call fcn.00420fb8
mov edi, eax
dec edi
test edi, edi
jl 0x42e3c0
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00420f8c
mov edx, dword [0x4319b0]
call fcn.004037f4
test al, al
je 0x42e3bc
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00420f8c
lea edx, [ebp - 0x14]
call fcn.00438d10
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404a98
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404768
inc esi
dec edi
jne 0x42e36e
mov al, byte [0x42e4d4]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x42e4e0
mov eax, dword [ebp - 0xc]
call fcn.0040d938
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404480
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00438d10
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x42e4d0
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.00438d10
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x42e4d0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x42e4d0
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x42e4ec
call fcn.00409578
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e4c0
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.0040440c
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040440c
lea eax, [ebp - 0x14]
call fcn.004043e8
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040440c
ret

Function at 0x433864
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x4337b0
call sub.user32.dll_EnumWindows
ret