joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e5ba1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.100e5b1d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100e5d10
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100e5d10
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100e5cc5
jg 0x100e5bfd
test eax, eax
je 0x100e5cbb
push 1
push 0x1000
call fcn.100d6162
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100e5c20
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100e5cb2
push 0x8000
push ebx
call fcn.100e5a4e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100e5c49
jg 0x100e5c44
cmp ecx, 0x1000
jb 0x100e5c49
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100d7896
add esp, 0x10
cmp eax, 0xffffffff
je 0x100e5c8e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100e5c44
jl 0x100e5c75
test ecx, ecx
jne 0x100e5c36
push dword [ebp - 0xc]
push ebx
call fcn.100e5a4e
push esi
call fcn.100d4bc2
add esp, 0xc
xor ebx, ebx
jmp 0x100e5d1e
cmp byte [edi + 0x24], 0
je 0x100e5ca5
cmp dword [edi + 0x20], 5
jne 0x100e5ca5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100e5cb0
mov ebx, dword [edi + 0x18]
jmp 0x100e5cb2
xor ebx, ebx
push esi
call fcn.100d4bc2
pop ecx
jmp 0x100e5d1e
test ecx, ecx
jg 0x100e5c87
jl 0x100e5cc5
test eax, eax
jae 0x100e5c87
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100d8a2a
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100e5ce5
cmp byte [edi + 0x1c], 0
je 0x100e5c87
jmp 0x100e5d16
push ebx
call fcn.100da3bf
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100e5c87
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100e5d1e
cmp byte [edi + 0x1c], 0
je 0x100e5d1b
mov ebx, dword [edi + 0x18]
jmp 0x100e5d1e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100d8a2a
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100e6730
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100e675d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100e675d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x41fd1c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42c520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00416e92
and dword [ebp - 0x14], 0
cmp dword [0x45b068], 0
mov dword [ebp - 0x18], eax
jne 0x41fdcf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41fe77
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41fe77
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x45b068], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x45b06c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x45b070], eax
call edi
push eax
call esi
mov dword [0x45b078], eax
test eax, eax
je 0x41fdcf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x45b074], eax
mov eax, dword [0x45b074]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41fe28
cmp dword [0x45b078], ecx
je 0x41fe28
push eax
call esi
push dword [0x45b078]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41fe28
test ebx, ebx
je 0x41fe28
call edi
test eax, eax
je 0x41fe1f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41fe1f
test byte [ebp - 8], 1
jne 0x41fe28
or dword [ebp + 0x10], 0x200000
jmp 0x41fe5b
mov eax, dword [0x45b06c]
cmp eax, dword [ebp - 0x18]
je 0x41fe5b
push eax
call esi
test eax, eax
je 0x41fe5b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41fe5b
mov eax, dword [0x45b070]
cmp eax, dword [ebp - 0x18]
je 0x41fe5b
push eax
call esi
test eax, eax
je 0x41fe5b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x45b068]
call esi
test eax, eax
je 0x41fe77
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41fe79
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004113eb
leave
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40601c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x406028
push 0x406024
push 0x406020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x406028]
push dword [0x406024]
push dword [0x406020]
mov dword [0x406014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push edi
xor edi, edi
mov dword [ebp - 0x84], 0
call fcn.00401938
mov edi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, edi
or al, 0x40
push eax
lea eax, [0x404659]
lea edx, [fcn.0040199c]
sub eax, edx
push eax
push fcn.0040199c
call sub.KERNEL32.dll_VirtualProtect
cmp dword [ebp - 4], 0
je 0x401326
push edi
call fcn.00401830
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.00401885
mov eax, edi
add eax, 0x1e200
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x88]
xor eax, edi
push eax
lea eax, [0x4060e4]
or eax, edi
push eax
call fcn.0040199c
add esp, 0x18
xor eax, eax
pop edi
leave
ret

Function at 0x401938
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push edi
and dword [ebp - 0x120], 0
xor edi, edi
mov dword [ebp - 0x11c], 0x14
mov byte [ebp - 0x104], 0
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x118]
push eax
push 1
push 1
lea eax, [ebp - 0x104]
push eax
call sub.CRYPT32.DLL_CryptBinaryToStringW
movzx eax, word [ebp - 0x118]
mov edi, eax
sub edi, 0x41
mov eax, edi
pop edi
leave
ret
Function at 0x401560
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x1c]
or al, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x34], 0
jne 0x40157d
mov ecx, dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp + 0x34], ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x28]
push eax
mov ecx, dword [ebp + 0x24]
push ecx
mov edx, dword [ebp + 0x20]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp + 0x34]
test eax, eax
jne 0x4015b0
xor eax, eax
jmp 0x401628
cmp dword [ebp + 0x30], 0
je 0x4015ca
mov eax, dword [ebp + 0x30]
push eax
call fcn.004027c0
add esp, 4
add eax, 1
mov dword [ebp - 0x18], eax
jmp 0x4015d1
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 0x30]
push edx
call fcn.00401540
push eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00401630
add esp, 0x14
test eax, eax
jne 0x4015f7
xor eax, eax
jmp 0x401628
cmp dword [ebp + 0x2c], 0
je 0x40160f
push 0x10
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x2c]
push eax
call fcn.00402840
add esp, 0xc
mov ecx, dword [ebp + 0x1c]
and ecx, 4
test ecx, ecx
jne 0x401623
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
mov esp, ebp
pop ebp
ret 0x30
Function at 0x40daa0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00403620
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x40db6b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x40db6b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x40db1e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x40db29
or bh, 8
and edi, 0x8000000
je 0x40db44
mov eax, dword [0x422f3c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x40db6b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40df40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x40df6b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x40df8f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x40dfaa
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x411e51
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x411e93
call fcn.00414cd7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x411e93
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x411e8a
xor eax, eax
jmp 0x411e9b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00411ea1
pop edi
pop esi
pop ebx
ret 4

Function at 0x4153b3
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4153e1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4153ff
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00415319
jmp 0x4153ff
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4153ff
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00415319
test edi, edi
mov eax, edi
jne 0x4153e9
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4010b0
Capabilities:
Delete file
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
cmp dword [0x84c904], 0x594
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
push edi
mov dword [ebp - 8], eax
jne 0x4010db
push str.hokuxeyidofap_lafegohawuzusatuxakoterasiva_purumogihali
call dword [sym.imp.KERNEL32.dll_AddAtomW]
mov ecx, dword [0x42e0d8]
mov ebx, dword [0x42e0dc]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x2c], ecx
call fcn.004010a0
mov edx, dword [0x42e0e0]
mov eax, dword [0x42e0e4]
add dword [ebp - 0x18], 0x23f
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], eax
mov edi, 0x20
jmp 0x401120
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov ecx, dword [0x84c904]
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x401186
push 0
lea ecx, [ebp - 0x30]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_PurgeComm]
xor ecx, ecx
xor eax, eax
lea edx, [ebp - 0x34]
push edx
mov word [ebp - 0x1c], ax
mov word [ebp - 0x1a], cx
mov eax, dword [ebp - 0x1c]
push eax
push ecx
push str.kezurutiric
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
mov eax, dword [ebp - 4]
mov ecx, dword [0x84c904]
add eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
jne 0x4011a0
mov dword [0x84c900], 0xedeb2e40
jmp 0x4011c2
cmp ecx, 0x3eb
jne 0x4011c2
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [0x84c2b4], 0
mov ecx, dword [ebp - 0x18]
add ecx, esi
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0xc]
mov edx, esi
shr edx, cl
mov dword [0x84c8fc], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov edx, dword [ebp - 8]
shl edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
nop
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov eax, edx
shr eax, cl
mov ecx, dword [ebp - 4]
add eax, ebx
xor eax, dword [ebp - 0x14]
xor ecx, eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ecx
sub esi, ecx
call fcn.00401090
sub edi, 1
jne 0x401120
cmp dword [0x84c904], 0xa6d
mov edi, dword [ebp + 8]
mov dword [edi], esi
jne 0x401279
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [ebp - 8]
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4060bc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42db70]
jne 0x4060c6
repz ret
jmp fcn.004080c8

Function at 0x406e6b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402de0
and dword [ebp - 4], 0
cmp dword [0x42ed38], 0
mov ebx, eax
jne 0x406f1c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406fcd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406fcd
push eax
call fcn.00402d6e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42ed38], eax
call esi
push eax
call fcn.00402d6e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42ed3c], eax
call esi
push eax
call fcn.00402d6e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42ed40], eax
call esi
push eax
call fcn.00402d6e
pop ecx
mov dword [0x42ed48], eax
test eax, eax
je 0x406f1c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402d6e
pop ecx
mov dword [0x42ed44], eax
mov eax, dword [0x42ed44]
cmp eax, ebx
je 0x406f74
cmp dword [0x42ed48], ebx
je 0x406f74
push eax
call fcn.00402de9
push dword [0x42ed48]
mov esi, eax
call fcn.00402de9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406f74
test edi, edi
je 0x406f74
call esi
test eax, eax
je 0x406f6b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406f6b
test byte [ebp - 0xc], 1
jne 0x406f74
or dword [ebp + 0x10], 0x200000
jmp 0x406fad
mov eax, dword [0x42ed3c]
cmp eax, ebx
je 0x406fad
push eax
call fcn.00402de9
pop ecx
test eax, eax
je 0x406fad
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406fad
mov eax, dword [0x42ed40]
cmp eax, ebx
je 0x406fad
push eax
call fcn.00402de9
pop ecx
test eax, eax
je 0x406fad
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42ed38]
call fcn.00402de9
pop ecx
test eax, eax
je 0x406fcd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406fcf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402a24
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404428
test esi, esi
jne 0x402a5a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404518
jmp 0x402a78
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402938
mov edi, eax
test esi, esi
je 0x402a78
cmp dword [ebx], 0
je 0x402a78
dec esi
jmp 0x402a61
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403568
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x450020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403600
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4035e0
xor eax, eax
push ebp
push 0x4035d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40361c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4035e0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x450020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x450020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4042ac
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4c8048], 0
je 0x40430d
cmp word [0x4c821c], 0xd7b2
jne 0x4042d5
cmp dword [0x4c8224], 0
jbe 0x4042d5
mov eax, 0x4c8218
call dword [0x4c8234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x450070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404334
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x450030], 0
jne 0x404329
push 0
push 0x450068
push 0x450070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret