joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440600
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x473258
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x48c74c]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [0x48c74c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, edx
mov dword [esp + 0xc], eax
mov edi, ecx
mov ecx, eax
mov dword [esp + 0x20], 0
sub ecx, edi
mov eax, 0x81848da9
imul ecx
xorps xmm0, xmm0
movdqu xmmword [esp + 0x10], xmm0
mov dword [esp + 0x10], 0
add edx, ecx
mov dword [esp + 0x14], 0
sar edx, 9
mov esi, edx
mov dword [esp + 0x18], 0
shr esi, 0x1f
add esi, edx
lea eax, [esi + 1]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], 0
mov ecx, edi
push dword [esp + 0x40]
mov edx, dword [esp + 0x10]
push eax
push esi
call fcn.00440da0
add esp, 0xc
mov dword [esp + 0x30], 0xffffffff
mov esi, dword [esp + 0x10]
test esi, esi
je 0x4406e0
cmp esi, dword [esp + 0x18]
je 0x4406d7
mov edi, edi
mov ecx, esi
call fcn.0043c980
add esi, 0x3f4
cmp esi, dword [esp + 0x18]
jne 0x4406c0
mov esi, dword [esp + 0x10]
push esi
call fcn.0044b63d
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0044b642
add esp, 0x28
ret
Function at 0x442570
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x473580
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48c74c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov dword [esp + 0x1c], edx
mov ebp, ecx
mov ebx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
mov dword [esp + 0x20], eax
test ebx, ebx
je 0x442740
test esi, esi
je 0x442740
cmp ebx, esi
jg 0x442671
mov ecx, edi
call fcn.00441140
cmp ebx, eax
jg 0x442671
mov ecx, dword [edi + 0x10]
sub esp, 0x14
mov dword [esp + 0x2c], esp
mov eax, dword [ecx]
mov dword [ecx + 4], eax
mov ecx, esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [edi + 0x10]
mov dword [ecx + 0x10], eax
mov dword [esp + 0x54], 0
mov esi, dword [esp + 0x30]
push esi
mov dword [esp + 0x58], 0xffffffff
mov edx, ebp
lea ecx, [esp + 0x3c]
call fcn.00442370
add esp, 0x18
lea ecx, [esp + 0x24]
call fcn.00440700
push dword [esp + 0x18]
mov ebx, dword [esp + 0x24]
mov ecx, esi
push ebp
mov edx, ebx
call fcn.004431f0
mov eax, dword [edi + 0x10]
push dword [esp + 0x20]
push ebx
mov edx, dword [eax + 4]
mov ecx, dword [eax]
call fcn.004430e0
add esp, 0x10
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
mov ecx, edi
call fcn.00441140
cmp esi, eax
jg 0x442719
mov ecx, dword [edi + 0x10]
sub esp, 0x14
mov dword [esp + 0x2c], esp
mov eax, dword [ecx]
mov dword [ecx + 4], eax
mov ecx, esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [edi + 0x10]
mov dword [ecx + 0x10], eax
mov dword [esp + 0x54], 1
mov ebx, dword [esp + 0x34]
push ebx
mov dword [esp + 0x58], 0xffffffff
lea ecx, [esp + 0x3c]
mov edx, dword [esp + 0x34]
call fcn.00442370
add esp, 0x18
lea ecx, [esp + 0x24]
call fcn.00440700
push dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov ecx, ebp
push ebx
call fcn.004430e0
mov eax, dword [edi + 0x10]
push dword [esp + 0x20]
push ebp
mov edx, dword [eax + 4]
mov ecx, dword [eax]
call fcn.004431f0
add esp, 0x10
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
mov ebx, dword [esp + 0x20]
mov ecx, ebp
mov edx, dword [esp + 0x1c]
push ebx
call fcn.00442ff0
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
imul eax, esi, 0x3f4
add eax, ebp
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x442c40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x473639
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48c74c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov esi, edx
mov eax, ecx
mov dword [esp + 0x1c], eax
mov edi, dword [esp + 0x4c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x40], 1
mov ebp, dword [esp + 0x48]
mov ebx, dword [esp + 0x50]
cmp esi, ebp
je 0x442cc7
cmp edi, ebx
je 0x442cc7
push esi
mov ecx, edi
call fcn.0043cc30
lea ecx, [esp + 0x54]
test al, al
je 0x442cb7
push edi
call fcn.00443030
add edi, 0x3f4
cmp edi, ebx
jmp 0x442cc5
push esi
call fcn.00443030
add esi, 0x3f4
cmp esi, ebp
jne 0x442c97
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x2c], esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [esp + 0x78]
mov dword [ecx + 0x10], eax
mov byte [esp + 0x54], 2
push ebp
mov byte [esp + 0x58], 1
mov edx, esi
lea ecx, [esp + 0x3c]
call fcn.00442370
add esp, 0x18
mov byte [esp + 0x40], 3
mov eax, dword [eax + 0x10]
mov dword [esp + 0x64], eax
mov byte [esp + 0x40], 1
mov esi, dword [esp + 0x24]
test esi, esi
je 0x442d50
cmp esi, dword [esp + 0x2c]
je 0x442d47
lea ebx, [ebx]
mov ecx, esi
call fcn.0043c980
add esi, 0x3f4
cmp esi, dword [esp + 0x2c]
jne 0x442d30
mov esi, dword [esp + 0x24]
push esi
call fcn.0044b63d
add esp, 4
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x2c], esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [esp + 0x78]
mov dword [ecx + 0x10], eax
mov byte [esp + 0x54], 4
push ebx
mov byte [esp + 0x58], 1
mov edx, edi
mov edi, dword [esp + 0x34]
mov ecx, edi
call fcn.00442370
add esp, 0x18
mov dword [esp + 0x14], 1
mov byte [esp + 0x40], 0
mov esi, dword [esp + 0x54]
test esi, esi
je 0x442dd1
cmp esi, dword [esp + 0x5c]
je 0x442dc8
mov ecx, esi
call fcn.0043c980
add esi, 0x3f4
cmp esi, dword [esp + 0x5c]
jne 0x442db1
mov esi, dword [esp + 0x54]
push esi
call fcn.0044b63d
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x444580
Capabilities:
Check os version

Disassembly:
sub esp, 0x10
push esi
push 0x11c
mov esi, ecx
push 0
push esi
call fcn.00451b50
add esp, 0xc
mov dword [esi], 0x11c
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x444611
mov eax, dword [esi + 4]
cmp eax, 6
ja 0x4445b7
jne 0x44460a
cmp dword [esi + 8], 2
jb 0x44460a
lea eax, [esp + 0x10]
mov dword [esp + 4], 0
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0
push eax
lea edx, [esp + 0x10]
mov dword [esp + 0x14], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
call fcn.00444620
add esp, 8
test al, al
je 0x44460a
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
mov eax, dword [esp + 8]
mov dword [esi + 8], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0xc], eax
mov al, 1
pop esi
add esp, 0x10
ret
xor al, al
pop esi
add esp, 0x10
ret

Function at 0x444620
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x28
mov eax, dword [0x48c74c]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
push ebx
push ebp
mov ebp, dword [esp + 0x34]
mov ebx, edx
push esi
push edi
push str.kernel32.dll
mov edi, ecx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x4446ea
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4446ea
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4446ea
movdqu xmm0, xmmword [0x47e9a4]
push eax
movdqu xmmword [esp + 0x18], xmm0
movdqu xmm0, xmmword [0x47e9b4]
movdqu xmmword [esp + 0x28], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4446ea
lea eax, [esp + 0x14]
push eax
lea ecx, [esi + 6]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4446ea
cmp word [esi + 2], ax
jbe 0x4446ea
movzx eax, word [esi + 0x32]
mov ecx, dword [esp + 0x10]
mov dword [edi], eax
movzx eax, word [esi + 0x30]
mov dword [ebx], eax
movzx eax, word [esi + 0x36]
mov dword [ebp], eax
movzx eax, word [esi + 0x34]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
mov al, 1
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0044b642
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044b642
add esp, 0x28
ret
Function at 0x444e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push esi
mov dword [esp + 4], 0x10d040e
xor esi, esi
mov dword [esp + 8], 0x80b0f02
mov dword [esp + 0xc], 0xc060a03
mov dword [esp + 0x10], 0x7000905
mov dword [esp + 0x14], 0xe08010f
mov dword [esp + 0x18], 0x4030b06
mov dword [esp + 0x1c], 0xd020709
mov dword [esp + 0x20], 0xa05000c
mov dword [esp + 0x24], 0xe09000a
mov dword [esp + 0x28], 0x50f0306
mov dword [esp + 0x2c], 0x70c0d01
mov dword [esp + 0x30], 0x802040b
mov dword [esp + 0x34], 0x30e0d07
mov dword [esp + 0x38], 0xa090600
mov dword [esp + 0x3c], 0x5080201
mov dword [esp + 0x40], 0xf040c0b
mov dword [esp + 0x44], 0x1040c02
mov dword [esp + 0x48], 0x60b0a07
mov dword [esp + 0x4c], 0xf030508
mov dword [esp + 0x50], 0x90e000d
mov dword [esp + 0x54], 0xf0a010c
mov dword [esp + 0x58], 0x8060209
mov dword [esp + 0x5c], 0x4030d00
mov dword [esp + 0x60], 0xb05070e
mov dword [esp + 0x64], 0xe020b04
mov dword [esp + 0x68], 0xd08000f
mov dword [esp + 0x6c], 0x7090c03
mov dword [esp + 0x70], 0x1060a05
mov dword [esp + 0x74], 0x408020d
mov dword [esp + 0x78], 0x10b0f06
mov dword [esp + 0x7c], 0xe03090a
mov dword [esp + 0x80], 0x70c0005
lea esp, [esp]
mov ecx, esi
mov edx, esi
sar ecx, 4
and edx, 0xf
movzx eax, byte [esp + ecx + 4]
shl al, 4
or al, byte [esp + edx + 0x14]
mov byte [esi + 0x48f670], al
movzx eax, byte [esp + ecx + 0x24]
shl al, 4
or al, byte [esp + edx + 0x34]
mov byte [esi + 0x48f770], al
movzx eax, byte [esp + ecx + 0x44]
shl al, 4
or al, byte [esp + edx + 0x54]
mov byte [esi + 0x48f870], al
movzx eax, byte [esp + ecx + 0x64]
shl al, 4
or al, byte [esp + edx + 0x74]
mov byte [esi + 0x48f570], al
inc esi
cmp esi, 0x100
jl 0x444f70
pop esi
add esp, 0x80
ret
Function at 0x447460
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x473ae6
mov eax, dword fs:[0]
push eax
sub esp, 0x82c
mov eax, dword [0x48c74c]
xor eax, esp
mov dword [esp + 0x828], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48c74c]
xor eax, esp
push eax
lea eax, [esp + 0x840]
mov dword fs:[0], eax
mov dword [esp + 0x1c], ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea eax, [esp + 0x3c]
push eax
push 0x3fe
call edi
mov ebp, eax
test ebp, ebp
je 0x447529
lea eax, [esp + 0x3c]
xor esi, esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x38], esi
mov dword [esp + 0x848], esi
cmp ebp, 0x3fe
jbe 0x447553
xor ecx, ecx
lea eax, [ebp + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004477c6
add esp, 4
mov ebx, eax
mov esi, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x38], esi
push ebx
push ebp
call edi
test eax, eax
je 0x447511
cmp eax, ebp
ja 0x447511
xor ecx, ecx
mov ebp, eax
mov dword [ebx + eax*2], ecx
jmp 0x44757f
mov dword [esp + 0x848], 0xffffffff
test ebx, ebx
je 0x447529
push ebx
call fcn.0044bee9
add esp, 4
xor al, al
mov ecx, dword [esp + 0x840]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x828]
xor ecx, esp
call fcn.0044b642
add esp, 0x838
ret
lea eax, [ebp*2]
cmp eax, 0x800
jae 0x44761f
xor ecx, ecx
mov word [esp + eax + 0x3c], cx
add eax, 2
cmp eax, 0x800
jae 0x44761f
mov word [esp + eax + 0x3c], cx
xor eax, eax
xor edi, edi
test ebp, ebp
je 0x447600
mov esi, dword [esp + 0x18]
mov ebx, 2
cmp word [esi + ebx - 2], 0
jne 0x4475f4
cmp eax, edi
je 0x4475f4
lea eax, [esi + eax*2]
push eax
lea ecx, [esp + 0x24]
call fcn.00402c40
mov byte [esp + 0x848], 1
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
call fcn.00411350
mov byte [esp + 0x848], 0
cmp dword [esp + 0x34], 8
jb 0x4475da
push dword [esp + 0x20]
call fcn.0044b63d
add esp, 4
xor eax, eax
mov dword [esp + 0x34], 7
mov word [esp + 0x20], ax
lea eax, [edi + 1]
mov dword [esp + 0x30], 0
inc edi
add ebx, 2
cmp edi, ebp
jb 0x447590
mov esi, dword [esp + 0x38]
mov dword [esp + 0x848], 0xffffffff
test esi, esi
je 0x447618
push esi
call fcn.0044bee9
add esp, 4
mov al, 1
jmp 0x44752b
call fcn.0044c048
int3
Function at 0x45f689
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x48c74c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00451541
mov dword [ebp - 0x14], eax
cmp dword [0x48f3f0], esi
jne 0x45f77c
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x45f709
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x45f85c
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x45f85c
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45f85c
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x48f3f0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x48f3f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x48f3f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x48f400], eax
test eax, eax
je 0x45f779
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x48f3fc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x45f7a1
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x45f794
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x45f7b6
push 4
pop eax
jmp 0x45f85e
cmp dword [ebp - 0x14], esi
je 0x45f7b6
push dword [0x48f3f0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x45f79b
mov eax, dword [0x48f3fc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x45f814
cmp dword [0x48f400], edi
je 0x45f814
push eax
call ebx
push dword [0x48f400]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x45f814
test eax, eax
je 0x45f814
call ecx
test eax, eax
je 0x45f809
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x45f809
test byte [ebp - 8], 1
jne 0x45f814
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x45f844
mov eax, dword [0x48f3f4]
cmp eax, edi
je 0x45f841
push eax
call ebx
test eax, eax
je 0x45f841
call eax
mov esi, eax
test esi, esi
je 0x45f841
mov eax, dword [0x48f3f8]
cmp eax, edi
je 0x45f841
push eax
call ebx
test eax, eax
je 0x45f841
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x48f3f0]
call ebx
test eax, eax
je 0x45f85c
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x45f85e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044b642
mov esp, ebp
pop ebp
ret
Function at 0xac70b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00ac7200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xac70d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xac70c2
add dl, dl
jne 0xac70e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xac7134
xor eax, eax
add dl, dl
jne 0xac70ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xac71d5
add dl, dl
jne 0xac70fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xac7108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xac7113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xac711e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xac712a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xac70cd
mov eax, 1
add dl, dl
jne 0xac7142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xac714d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xac7139
sub eax, ebx
mov ebx, 1
jne 0xac7180
mov ecx, 1
add dl, dl
jne 0xac7166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xac7171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xac715d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xac70cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xac7197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xac71a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xac718e
cmp eax, 0x7d00
jae 0xac71c5
cmp eax, 0x500
jb 0xac71c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xac70cd
cmp eax, 0x7f
ja 0xac71c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xac70cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xac71f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xac70cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4026f4
Capabilities:
Access the windows event log
Clear windows event logs
Get common file path
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
xor ebx, ebx
call edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp ebx, 0x58ce99d
jg 0x402724
inc ebx
cmp ebx, 0x1f6502b0
jl 0x40270a
cmp dword [0x47c26c], 0x400
jne 0x4027aa
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
lea eax, [ebp - 0x800]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
push str.Josebocusomal_kur_pidijazosanu
push esi
call dword [sym.imp.ADVAPI32.dll_BackupEventLogW]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push str.nojojatobajehivonafepuxefemi
push esi
call fcn.00402bf8
push esi
push esi
call fcn.00402e74
fldz
add esp, 8
fstp qword [esp]
call fcn.00402d10
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004029d0
fstp st(0)
push esi
call fcn.00402f21
push esi
call fcn.00402f30
add esp, 0x10
xor ebx, ebx
cmp ebx, 0xd0fe
jge 0x4027bb
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp ebx, 0x58bc6e
jg 0x4027d5
inc ebx
cmp ebx, 0xe52f
jl 0x4027ac
mov eax, dword [0x475304]
mov dword [0x47c26c], eax
call fcn.0040247d
mov edi, 0x3078f
cmp dword [0x47c26c], 0x51f
jne 0x402803
push esi
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec edi
jne 0x4027e9
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x40716e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x474d48]
jne 0x407178
repz ret
jmp fcn.00409a0f
Function at 0x4095da
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x474d48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404186
and dword [ebp - 0x14], 0
cmp dword [0x476e24], 0
mov dword [ebp - 0x18], eax
jne 0x40968d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x409735
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x409735
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x476e24], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x476e28], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x476e2c], eax
call edi
push eax
call esi
mov dword [0x476e34], eax
test eax, eax
je 0x40968d
push 0x472c90
push ebx
call edi
push eax
call esi
mov dword [0x476e30], eax
mov eax, dword [0x476e30]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4096e6
cmp dword [0x476e34], ecx
je 0x4096e6
push eax
call esi
push dword [0x476e34]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4096e6
test ebx, ebx
je 0x4096e6
call edi
test eax, eax
je 0x4096dd
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4096dd
test byte [ebp - 8], 1
jne 0x4096e6
or dword [ebp + 0x10], 0x200000
jmp 0x409719
mov eax, dword [0x476e28]
cmp eax, dword [ebp - 0x18]
je 0x409719
push eax
call esi
test eax, eax
je 0x409719
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x409719
mov eax, dword [0x476e2c]
cmp eax, dword [ebp - 0x18]
je 0x409719
push eax
call esi
test eax, eax
je 0x409719
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x476e24]
call esi
test eax, eax
je 0x409735
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x409737
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040716e
leave
ret
Function at 0x401300
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401319
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401354
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401350
lea ebx, [ebx]
cmp esi, eax
jae 0x401354
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401340
cmp esi, eax
jb 0x40135a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x403320
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x48291a
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4ace78]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
sub eax, 0x10
push eax
call fcn.00401630
add eax, 0x10
mov dword [esi], eax
mov eax, dword [edi + 4]
sub eax, 0x10
push eax
mov dword [esp + 0x20], 0
call fcn.00401630
add eax, 0x10
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
sub eax, 0x10
push eax
mov byte [esp + 0x24], 1
call fcn.00401630
add eax, 0x10
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
sub eax, 0x10
push eax
mov byte [esp + 0x28], 2
call fcn.00401630
add eax, 0x10
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
sub eax, 0x10
push eax
mov byte [esp + 0x2c], 3
call fcn.00401630
add eax, 0x10
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
sub eax, 0x10
push eax
mov byte [esp + 0x30], 4
call fcn.00401630
add eax, 0x10
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
sub eax, 0x10
push eax
mov byte [esp + 0x34], 5
call fcn.00401630
add eax, 0x10
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
sub eax, 0x10
push eax
mov byte [esp + 0x38], 6
call fcn.00401630
add esp, 0x20
add eax, 0x10
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4