joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43401c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x434038
cmp dword [esi + 4], 0
je 0x434065
test byte [ebx + 0x55], 1
jne 0x434057
mov eax, ebx
call fcn.00432c28
test eax, eax
jne 0x434057
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x434175
mov edx, esi
mov eax, ebx
call fcn.00433b40
jmp 0x434175
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43416e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00435e8c
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00430930
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0043401c
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00435e8c
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434175
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a5d4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x54518c]
cmp byte [eax + 0xc], 0
je 0x43a741
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43a73a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x546afc], 0
jne 0x43a628
push 0x43a748
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x43a750
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x546afc], eax
cmp dword [0x457ab8], 0
jne 0x43a723
push 0x43a760
call sub.kernel32.dll_LoadLibraryA
mov dword [0x457ab8], eax
cmp dword [0x457ab8], 0
je 0x43a723
push 0x43a76c
mov eax, dword [0x457ab8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x546b00], eax
push 0x43a77c
mov eax, dword [0x457ab8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x546b04], eax
push 0x43a790
mov eax, dword [0x457ab8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x546b08], eax
push 0x43a7a8
mov eax, dword [0x457ab8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x546b0c], eax
push 0x43a7c0
mov eax, dword [0x457ab8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x546b10], eax
push 0x43a7d4
mov eax, dword [0x457ab8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x546b14], eax
push 0x43a7ec
mov eax, dword [0x457ab8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x546b18], eax
push 0x43a804
mov eax, dword [0x457ab8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x546b1c], eax
push 0x43a820
mov eax, dword [0x457ab8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x546b20], eax
push 0x43a82c
mov eax, dword [0x457ab8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x546b24], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a741
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x43e5f4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.0040424c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43e643
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004044bc
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x445dec
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x445e3c]
test si, 4
je 0x445e00
or bl, 1
test si, 8
je 0x445e0a
or bl, 4
test si, 1
je 0x445e14
or bl, 8
test si, 2
je 0x445e1e
or bl, 0x10
test si, 0x10
je 0x445e28
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x445e37
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x445e40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x445e78]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x445e59
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x445e68
or bl, 4
test esi, 0x20000000
je 0x445e73
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x44c53c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x44c54e
add esp, 0xfffffff0
call fcn.004037dc
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041cb88
mov eax, dword [0x544e2c]
mov dword [eax + 4], ebx
mov dword [eax], 0x44c8e0
mov eax, dword [0x544e38]
mov dword [eax + 4], ebx
mov dword [eax], 0x44c8ec
mov eax, ebx
call fcn.0044c8f8
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x414da0]
call fcn.0040348c
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x414da0]
call fcn.0040348c
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x414da0]
call fcn.0040348c
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x414da0]
call fcn.0040348c
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x414da0]
call fcn.0040348c
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x448d10
push eax
push 0
push 0
mov eax, dword [0x544f8c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41e600]
call fcn.0041fa68
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41e600]
call fcn.0041fa68
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41e600]
call fcn.0041fa68
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0044cd48
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44cc10
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44cc10
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44cc10
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44c68b
call fcn.00403834
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44c9f4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44cb9f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44cb80
mov dl, 1
mov eax, dword [0x4151bc]
call fcn.0040348c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.0040424c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44cb6f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043a934
test al, al
je 0x44cb62
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44cbb0
lea eax, [ebp - 0x254]
call fcn.00408fe0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44cb62
xor eax, eax
push ebp
push 0x44cb5b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44cbe8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44cb44
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004044bc
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44cb44
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004044bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44cb62
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44ca65
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00418d20
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44cba6
lea eax, [ebp - 0x260]
call fcn.0040424c
ret

Function at 0x44d4e8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x546b48]
cmp byte [eax + 0xa5], 0
jne 0x44d559
cmp dword [0x546b60], 0
jne 0x44d51a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44d4a4
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x546b60], eax
cmp dword [0x546b5c], 0
jne 0x44d535
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x546b5c], eax
cmp dword [0x546b64], 0
jne 0x44d559
push esp
push 0
push 0
push 0x44d448
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x546b64], eax
pop edx
ret
Function at 0x44dbec
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x546b48]
cmp dword [eax + 0x30], 0
je 0x44dc96
cmp dword [ebx + 0x94], 0
jne 0x44dc90
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44db7c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44dc90
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44dc56
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44dc90
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041711c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44dc65
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44e7f4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44e829
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040433c
jmp 0x44e836
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004042a0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44f948
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44f989
mov eax, esi
call fcn.004360ec
test al, al
je 0x44f989
mov eax, dword [ebx + 0x84]
call fcn.00435e8c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44f989
push 0
mov eax, dword [ebx + 0x84]
call fcn.00435e8c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x450e04
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4145e8]
call fcn.00404bbc
xor eax, eax
push ebp
push 0x450f48
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x457d48], 0
jne 0x450e57
mov ecx, dword [0x544d8c]
mov dl, 1
mov eax, dword [0x4073d0]
call fcn.0040ba38
call fcn.00403c44
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402eb0
mov eax, ebx
call fcn.00404a88
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x450f58
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405bcc
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404a98
test eax, eax
jle 0x450eef
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x450ee8
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004044d4
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004044bc
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004081e0
test eax, eax
jne 0x450ee8
mov ebx, 0x15
jmp 0x450ef4
mov ebx, 0x10
jmp 0x450ef4
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x457d48]
call fcn.00450c7c
mov eax, dword [ebp - 8]
call fcn.00450c7c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405be4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450f4f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404270
lea eax, [ebp - 0x10]
mov edx, dword [0x4145e8]
call fcn.00404c80
ret

Function at 0x4523e4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004046fc
mov eax, dword [ebp - 8]
call fcn.004046fc
xor eax, eax
push ebp
push 0x45248d
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebp - 4]
push esi
call sub.kernel32.dll_LoadLibraryW
test eax, eax
push esi
call sub.kernel32.dll_GetModuleHandleW
mov dword [0x546c14], eax
cmp dword [0x546c14], 0
je 0x452472
mov eax, dword [ebp - 8]
call fcn.0040470c
push eax
mov eax, dword [0x546c14]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x546c18], eax
push 0x546c1c
push 0x40
push 0x55d468d
push 0x546c18
call sub.kernel32.dll_VirtualProtect
mov edx, 0x546c18
mov eax, sub.kernel32.dll_GetCPInfo
mov ecx, 4
call fcn.004523d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452494
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404270
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x23e16d8c
nop
nop
nop
nop
test eax, eax
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x1ace3ec8
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401220
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x8f9160]
mov ecx, dword [0x8f80b4]
shr eax, 3
sub esp, 0x81c
test eax, eax
jbe 0x401328
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
lea ebx, [ebx]
cmp dword [0x8f9160], 0x959
jne 0x40130e
push 0
call esi
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
push str.ducofikinevodugucexejayeyide_jofubupazekatajikuwayoj
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push 0
lea eax, [ebp - 0x81c]
push eax
push 0
push str.lebogegimoramigefunolerulodidi_peyewuvuhicucalikid_suyucedizejabije
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0
push 0
push str.kemafuvoriwidekubinujogin
push str.vuvetutijapaliy
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
xor eax, eax
push eax
push eax
lea ecx, [ebp - 0x1c]
push ecx
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
push 0
push 0
push 0
push 0
push 0
push 0
push str.laduvig_xupewufodarahut
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, dword [ebp - 4]
push edx
call fcn.00401030
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x401260
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402570
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4d90c8]
jne 0x40257a
repz ret
jmp fcn.00405f0e

Function at 0x405b3b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402ff9
and dword [ebp - 4], 0
cmp dword [0x4dab28], 0
mov ebx, eax
jne 0x405bec
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405c9d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405c9d
push eax
call fcn.00402f87
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4dab28], eax
call esi
push eax
call fcn.00402f87
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4dab2c], eax
call esi
push eax
call fcn.00402f87
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4dab30], eax
call esi
push eax
call fcn.00402f87
pop ecx
mov dword [0x4dab38], eax
test eax, eax
je 0x405bec
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402f87
pop ecx
mov dword [0x4dab34], eax
mov eax, dword [0x4dab34]
cmp eax, ebx
je 0x405c44
cmp dword [0x4dab38], ebx
je 0x405c44
push eax
call fcn.00403002
push dword [0x4dab38]
mov esi, eax
call fcn.00403002
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405c44
test edi, edi
je 0x405c44
call esi
test eax, eax
je 0x405c3b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405c3b
test byte [ebp - 0xc], 1
jne 0x405c44
or dword [ebp + 0x10], 0x200000
jmp 0x405c7d
mov eax, dword [0x4dab2c]
cmp eax, ebx
je 0x405c7d
push eax
call fcn.00403002
pop ecx
test eax, eax
je 0x405c7d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405c7d
mov eax, dword [0x4dab30]
cmp eax, ebx
je 0x405c7d
push eax
call fcn.00403002
pop ecx
test eax, eax
je 0x405c7d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4dab28]
call fcn.00403002
pop ecx
test eax, eax
je 0x405c9d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405c9f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x29b779b
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x19857d76
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x41b390
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov edx, dword [ebp + 0xc]
lea eax, [edx + 5]
push esi
cmp eax, 4
ja case.0x41b3a7.2
jmp dword [eax*4 + 0x41b484]
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x5c]
or dword [esi + 0x68], 4
test eax, eax
je 0x41b3d8
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x10000000
jne 0x41b3d8
mov eax, dword [esi + 0x5c]
push 8
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, dword [ebp + 8]
xor eax, eax
add ecx, 0xffffffbc
cmp edx, 0xfffffffc
sete al
push eax
call fcn.0041bb30
pop esi
mov esp, ebp
pop ebp
ret 0x1c
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 8]
mov edx, dword [ecx + 0x18]
lea eax, [esi + 8]
push eax
call edx
test byte [esi + 0x68], 4
je 0x41b438
mov eax, dword [esi + 0x5c]
and dword [esi + 0x68], 0xfffffffb
test eax, eax
je 0x41b438
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x10000000
je 0x41b438
mov eax, dword [esi + 0x5c]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, str.FAIL
test edx, edx
jle 0x41b465
push 0x30e
push 0x4b02cc
call fcn.0041a8d0
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x1c
push 0x31a
push str.Unrecognized_Negative_verb_in_DoVerb__.__bad.
call fcn.0041a8d0
add esp, 8
mov eax, 0x80004001
pop esi
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x420cf0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4ae9fc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x420ce0
call fcn.00470ba7
add esp, 4
call fcn.00420ba0
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x420d7e
lea ecx, [ebp - 0x20]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x420d44
mov edx, dword [ebp - 0x18]
push edx
jmp 0x420d78
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
push 0
push 0
push 0x10
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
push 0
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0044ac70
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046d3f1
mov esp, ebp
pop ebp
ret