joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4301f0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4531a9
mov eax, dword fs:[0]
push eax
sub esp, 0xe4
mov eax, dword [0x46b070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push ecx
mov ecx, esi
call fcn.00401220
cmp eax, 1
je 0x4303a2
cmp word [0x46d6c8], 0
jne 0x430265
push 0x46d6c8
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x430265
push 0x462c74
push 0x46d6c8
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
sub esp, 8
lea ecx, [ebp - 0xf0]
call fcn.004027b0
mov edx, 0x462e08
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xe0]
call fcn.004098a0
mov edx, esi
mov ecx, eax
call fcn.00409350
mov edx, 0x462e04
mov ecx, eax
call fcn.004098a0
mov edx, str.___type
mov ecx, eax
call fcn.004098a0
mov edx, edi
mov ecx, eax
call fcn.00409350
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xf0]
call fcn.004026a0
xorps xmm0, xmm0
movups xmmword [ebp - 0x3c], xmm0
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x2c], 0
jb 0x4302df
mov ecx, dword [eax]
jmp 0x4302e1
mov ecx, eax
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.0041f680
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x430306
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.0040d960
mov edx, dword [ebp - 0x3c]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
test edx, edx
jne 0x43034b
push 0x4625c4
lea ecx, [ebp - 0x38]
call fcn.0040f770
mov eax, dword [ebp - 0x34]
mov esi, dword [ebp - 0x38]
sub eax, esi
sar eax, 1
jne 0x430344
push str.invalid_vector_T__subscript
call fcn.004313e7
mov edx, esi
mov dword [ebp - 0x3c], edx
jmp 0x43034e
mov esi, dword [ebp - 0x38]
push dword [ebp + 0x10]
mov ecx, 0x46d6c8
call fcn.00416520
add esp, 4
mov edi, eax
test esi, esi
je 0x430375
mov ecx, dword [ebp - 0x30]
sub ecx, esi
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x38]
call fcn.0040d960
lea ecx, [ebp - 0x88]
call fcn.004026c0
lea eax, [ebp - 0x88]
mov dword [ebp - 4], 5
push eax
mov dword [ebp - 0x88], vtable.std::ios_base.0
call fcn.00431459
add esp, 4
jmp 0x4303a7
mov edi, 1
test edi, edi
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004330a2
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4303d0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453209
mov eax, dword fs:[0]
push eax
sub esp, 0xe4
mov eax, dword [0x46b070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp word [0x46d4c0], 0
mov bl, byte [ebp + 8]
mov edi, dword [ebp + 0xc]
jne 0x430435
push 0x46d4c0
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x430435
push str.CanonIJPLMIJPLMAGR.EXE
push 0x46d4c0
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
sub esp, 8
lea ecx, [ebp - 0xf0]
call fcn.004027b0
mov eax, 0x462e30
mov dword [ebp - 4], 0
cmp bl, 1
lea ecx, [ebp - 0xe0]
mov edx, str.__D__W
cmovne edx, eax
call fcn.004098a0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xf0]
call fcn.004026a0
xorps xmm0, xmm0
movups xmmword [ebp - 0x3c], xmm0
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x2c], 0
jb 0x430490
mov ecx, dword [eax]
jmp 0x430492
mov ecx, eax
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.0041f680
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4304b7
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.0040d960
mov edx, dword [ebp - 0x3c]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
test edx, edx
jne 0x4304fc
push 0x4625c4
lea ecx, [ebp - 0x38]
call fcn.0040f770
mov eax, dword [ebp - 0x34]
mov esi, dword [ebp - 0x38]
sub eax, esi
sar eax, 1
jne 0x4304f5
push str.invalid_vector_T__subscript
call fcn.004313e7
mov edx, esi
mov dword [ebp - 0x3c], edx
jmp 0x4304ff
mov esi, dword [ebp - 0x38]
push edi
mov ecx, 0x46d4c0
call fcn.00416650
add esp, 4
test eax, eax
setne bl
test esi, esi
je 0x430527
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x38]
sub eax, esi
sar eax, 1
push eax
push esi
call fcn.0040d960
lea ecx, [ebp - 0x88]
call fcn.004026c0
lea eax, [ebp - 0x88]
mov dword [ebp - 4], 5
push eax
mov dword [ebp - 0x88], vtable.std::ios_base.0
call fcn.00431459
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004330a2
mov esp, ebp
pop ebp
ret 8

Function at 0x430580
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x20006
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4305df
mov ecx, dword [ebp + 0xc]
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x4305bb
mov ecx, dword [ecx]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop esi
sete al
mov esp, ebp
pop ebp
ret 8
Function at 0x430810
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, edx
mov dword [esp + 0x1c], ecx
nop dword [eax + eax]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0x20019
push 0
push str.SoftwareCanonIJPLM
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
push 0x80000002
movlpd qword [esp + 0x3c], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x430987
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 8
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push str.InstallDate
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x10]
mov esi, eax
call edi
test esi, esi
jne 0x430987
mov esi, dword [esp + 0x28]
mov eax, esi
mov edi, dword [esp + 0x2c]
or eax, edi
je 0x430987
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
test ebx, ebx
je 0x4308d0
mov dword [ebx], ecx
mov dword [ebx + 4], eax
cmp eax, edi
jb 0x430915
ja 0x4308da
cmp ecx, esi
jbe 0x430915
sub ecx, esi
push 0xc9
push 0x2a69c000
sbb eax, edi
push eax
push ecx
call fcn.00433a60
mov ecx, eax
mov dword [esp + 0x20], eax
and ecx, edx
mov dword [esp + 0x24], edx
cmp ecx, 0xffffffff
je 0x430925
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
mov eax, 1
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x24], 0xffffffff
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareCanonIJPLM
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x430830
push 8
lea eax, [esp + 0x34]
push eax
push 0xb
push 0
push str.InstallDate
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x18]
call edi
jmp 0x430830
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430990
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x46b070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
lea eax, [ebp - 0x11c]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SoftwareCanonIJPLM
push 0x80000002
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x430a5e
lea eax, [ebp - 0x128]
mov dword [ebp - 0x120], 0x270f
push eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x124], ebx
push eax
lea eax, [ebp - 0x130]
mov dword [ebp - 0x128], 4
push eax
push ebx
push str.UnsupportMajor
push dword [ebp - 0x11c]
mov dword [ebp - 0x12c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
lea eax, [ebp - 0x12c]
push eax
cmove edi, dword [ebp - 0x120]
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push str.UnsupportMinor
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x11c]
test eax, eax
cmove ebx, dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.00437ac0
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x430abe
cmp dword [ebp - 0x108], 2
jne 0x430abe
mov eax, dword [ebp - 0x114]
cmp eax, edi
ja 0x430abe
jne 0x430aac
cmp dword [ebp - 0x110], ebx
jae 0x430abe
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004330a2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop ebx
call fcn.004330a2
mov esp, ebp
pop ebp
ret

Function at 0x430b80
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, ecx
xor esi, esi
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x430be7
push esi
lea eax, [ebp - 4]
mov dword [ebp - 8], esi
push eax
push 1
xorps xmm0, xmm0
push str.D:_A_OICI_GWGRSDDTDC___BU__A_OICI_GWGRSDDTDC___AU__A_OICI_GA___BA__A_OICI_GA___SY_
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x430bcf
mov eax, dword [ebp - 4]
mov dword [ebp - 8], esi
lea esi, [ebp - 0x10]
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 0xc], eax
push esi
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, dword [ebp - 4]
test eax, eax
je 0x430be7
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x430c00
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x46b070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
call fcn.004310c0
test eax, eax
jne 0x430ceb
push 0x20a
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.00437ac0
push 0x20a
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00437ac0
add esp, 0x18
mov dword [ebp - 0x440], esi
xorps xmm0, xmm0
lea eax, [ebp - 0x218]
movaps xmmword [ebp - 0x460], xmm0
movaps xmmword [ebp - 0x450], xmm0
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x430ceb
lea eax, [ebp - 0x218]
push eax
push str._skernel32.dll
lea eax, [ebp - 0x428]
push 0x105
push eax
call fcn.00431160
add esp, 0x10
xor eax, eax
mov ecx, str.KERNEL32.DLL
mov word [ebp - 0x220], ax
call fcn.00401160
mov edi, eax
test edi, edi
je 0x430ceb
push str.GetNativeSystemInfo
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x430ce4
lea ecx, [ebp - 0x460]
push ecx
call eax
movzx esi, word [ebp - 0x460]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov ax, si
pop edi
xor ecx, ebp
pop esi
call fcn.004330a2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x4310c0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x46b070]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.00437ac0
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x108], 2
jne 0x43112e
cmp dword [ebp - 0x114], 5
jne 0x43112e
cmp dword [ebp - 0x110], 0
jne 0x43112e
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004330a2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004330a2
mov esp, ebp
pop ebp
ret
Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x69
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx eax, ax
jmp 0x401054
mov eax, str.net_start__AxonService_
push eax
call sub.msvcrt.dll_system
add esp, 4
jmp 0x401074
mov eax, str.net_stop__AxonService_
push eax
call sub.msvcrt.dll_system
add esp, 4
jmp 0x401074
mov eax, str.net_stop__AxonService___net_start__AxonService_
push eax
call sub.msvcrt.dll_system
add esp, 4
jmp 0x401074
cmp eax, 1
je 0x40101b
cmp eax, 2
je 0x40102e
cmp eax, 3
je 0x401041
jmp 0x401074
leave
ret

Function at 0x401149
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
nop
mov eax, 0x28
push eax
mov eax, 0
push eax
lea eax, [ebp - 0x28]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, 0x401076
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, 0x402066
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_RegisterClassA
mov eax, 0
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0x12c
push eax
mov eax, 0x258
push eax
mov eax, 0x80000000
push eax
mov eax, 0x80000000
push eax
mov eax, 0xcf0000
push eax
mov eax, str.GUI_Example
push eax
mov eax, str.MyWindowClass
push eax
mov eax, 0
push eax
call sub.user32.dll_CreateWindowExA
mov dword [ebp - 0x2c], eax
call sub.user32.dll_CreateMenu
mov dword [ebp - 0x30], eax
call sub.user32.dll_CreatePopupMenu
mov dword [ebp - 0x34], eax
mov eax, str.Start_PBX
push eax
mov eax, 1
push eax
mov eax, 0
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.user32.dll_AppendMenuA
mov eax, str.Stop_PBX
push eax
mov eax, 2
push eax
mov eax, 0
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.user32.dll_AppendMenuA
mov eax, str.Restart_PBX
push eax
mov eax, 3
push eax
mov eax, 0
push eax
mov eax, dword [ebp - 0x34]
push eax
call sub.user32.dll_AppendMenuA
mov eax, str.Operations
push eax
mov eax, dword [ebp - 0x34]
push eax
mov eax, 0x10
push eax
mov eax, dword [ebp - 0x30]
push eax
call sub.user32.dll_AppendMenuA
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x2c]
push eax
call sub.user32.dll_SetMenu
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 0x2c]
push eax
call sub.user32.dll_ShowWindow
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, 0
push eax
lea eax, [ebp - 0x50]
push eax
call sub.user32.dll_GetMessageA
cmp eax, 0
je 0x4012a4
lea eax, [ebp - 0x50]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x50]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x40126c
mov eax, dword [ebp - 0x48]
leave
ret 0x10
Function at 0x401353
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
nop
lea eax, [ebp - 0x44]
push eax
call sub.kernel32.dll_GetStartupInfoA
mov eax, dword [ebp - 0x18]
and eax, 1
cmp eax, 0
je 0x401381
movzx eax, word [ebp - 0x14]
mov dword [ebp - 0x50], eax
jmp 0x401389
mov eax, 0xa
mov dword [ebp - 0x50], eax
mov eax, 0
mov dword [ebp - 0x48], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
cmp eax, 0
je 0x4013b8
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x4c]
push eax
call sub.msvcrt.dll_strstr
add esp, 8
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
cmp eax, 0
jne 0x4013da
mov eax, 0x4020b8
push eax
call sub.msvcrt.dll__strdup
add esp, 4
mov dword [ebp - 0x48], eax
jmp 0x4013ff
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
cmp eax, ecx
jbe 0x4013ff
mov eax, dword [ebp - 0x48]
dec eax
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x4013ff
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
mov eax, 0x30000
push eax
mov eax, 0x10000
push eax
call sub.msvcrt.dll__controlfp
add esp, 8
mov eax, dword [sym.imp.msvcrt.dll___argc]
mov ecx, dword [sym.imp.msvcrt.dll___argv]
mov edx, dword [sym.imp.msvcrt.dll__environ]
mov dword [ebp - 0x58], eax
mov eax, dword [edx]
push eax
mov eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
push eax
call fcn.004012ac
add esp, 0xc
mov eax, 0
push eax
call sub.kernel32.dll_GetModuleHandleA
mov ecx, dword [ebp - 0x50]
push ecx
mov ecx, dword [ebp - 0x48]
push ecx
mov ecx, 0
push ecx
push eax
call fcn.00401149
mov dword [ebp - 0x54], eax
call fcn.00401308
mov eax, dword [ebp - 0x54]
leave
ret
Function at 0x4283d0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
jmp 0x4283e8
mov eax, dword [ebp - 4]
jmp 0x46061d
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x42848c
mov edx, dword [ebp - 4]
sub edx, 0x231d
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + eax*2 + 0x463a]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
shr eax, 0xc
cmp eax, 3
jne 0x428487
mov ecx, dword [ebp - 8]
push ecx
call fcn.004289b0
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x428446
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x428446
xor eax, eax
jmp 0x42848c
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax - 0x4c3f8]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + edx]
add ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov edx, dword [ebp + 0x10]
mov dword [edx + eax], ecx
mov eax, dword [ebp - 8]
sub eax, 0x4c3f8
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
sub edx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
jmp 0x4283df
mov esp, ebp
pop ebp
ret

Function at 0x751bd7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [esp], 0xa4b9
rep movsb byte es:[edi], byte [esi]
or di, 0x1aba
mov edi, dword [esp + 0x28]
mov word [esp + 0xc], 0xa0bb
bts si, 0xc
jmp 0x75264a
mov esi, dword [esp + 0x2c]
bt ebp, ebp
test ah, 0x41
std
push dword [esp + 0x30]
popfd
mov dword [esp + 4], esi
pushfd
mov byte [esp + 4], 0x6c
lea esp, [esp + 0x38]
jmp 0x753063

Function at 0x752a5c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push dword [esp + 8]
pushfd
mov byte [eax], dl
pushfd
mov byte [esp], cl
lea esp, [esp + 0x30]
jmp 0x753063
Function at 0x4012b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x3c], 0x61
mov byte [ebp - 0x3b], 0x64
mov byte [ebp - 0x3a], 0x76
mov byte [ebp - 0x39], 0x61
mov byte [ebp - 0x38], 0x70
mov byte [ebp - 0x37], 0x69
mov byte [ebp - 0x36], 0x33
mov byte [ebp - 0x35], 0x32
mov byte [ebp - 0x34], 0x2e
mov byte [ebp - 0x33], 0x64
mov byte [ebp - 0x32], 0x6c
mov byte [ebp - 0x31], 0x6c
mov byte [ebp - 0x30], 0
cmp dword [ebp + 8], 0
je 0x401319
cmp dword [ebp + 0xc], 0
jne 0x40131e
jmp 0x4013a1
push 0x1d810497
push 0x1d290451
call fcn.004010a0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40133b
jmp 0x4013a1
lea eax, [ebp - 0x3c]
push eax
call dword [ebp - 4]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40134d
jmp 0x4013a1
push 0x3dad0661
push 0x1c9c0445
call fcn.004010a0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40136a
jmp 0x4013a1
mov dword [ebp - 0x18], str.pM_w
mov dword [ebp - 0x20], 0x10
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call dword [ebp - 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x40139a
jmp 0x4013a1
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x4013b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0xe00
push 0x6c930948
push 0x120f0389
call fcn.004010a0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4013f6
jmp 0x401456
push 0x23cc0543
push 0x120f0389
call fcn.004010a0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401413
jmp 0x401456
push 4
push 0x3000
lea eax, [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0xc]
push ecx
push 0xffffffffffffffff
call dword [ebp - 4]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x401434
jmp 0x401456
push 0xe00
push section..data
mov edx, dword [ebp - 0xc]
push edx
call dword [ebp - 8]
push 0xe00
mov eax, dword [ebp - 0xc]
push eax
call fcn.004012b0
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]