joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414a61
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0xc]
push edi
push eax
xor ebx, ebx
mov dword [ebp - 0x14], edx
push 0x2001f
push ebx
push str.Software
push 0x80000001
mov edi, ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x414b33
lea eax, [ebp - 4]
push eax
push 0x2001f
push ebx
push str.BugSplat
push dword [ebp - 0xc]
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x414add
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push 0x2001f
push eax
push eax
push eax
push str.BugSplat
push dword [ebp - 0xc]
call ebx
test eax, eax
jne 0x414b33
lea eax, [ebp - 8]
push eax
push 0x2001f
push 0
push edi
push dword [ebp - 4]
call esi
test eax, eax
je 0x414b0f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
push 0x2001f
push eax
push eax
push eax
push edi
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x414b33
push dword [ebp + 8]
call fcn.0041e578
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 8]
push 1
push 0
push dword [ebp - 0x14]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 8], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x414b44
push dword [ebp - 8]
call esi
cmp dword [ebp - 4], 0
je 0x414b4f
push dword [ebp - 4]
call esi
cmp dword [ebp - 0xc], 0
je 0x414b5a
push dword [ebp - 0xc]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414b61
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x44b4b8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.BugSplat
push str.SYSTEMCurrentControlSetServicesEventLogApplication_s
mov esi, 0x104
lea eax, [ebp - 0x20c]
xor edi, edi
push esi
push eax
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x210], edi
call fcn.0041f0d0
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [0x44d544]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.0041e578
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ecx
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 2
push edi
push str.EventMessageFile
push dword [ebp - 0x210]
call esi
push 4
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 7
push eax
push 4
push edi
push str.TypesSupported
push dword [ebp - 0x210]
call esi
cmp dword [ebp - 0x214], edi
jbe 0x414c72
lea eax, [ebp - 0x20c]
push eax
call fcn.0041e578
pop ecx
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 2
push edi
push str.CategoryMessageFile
push dword [ebp - 0x210]
call esi
push 4
lea eax, [ebp - 0x214]
push eax
push 4
push edi
push str.CategoryCount
push dword [ebp - 0x210]
call esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041d4e3
mov esp, ebp
pop ebp
ret
Function at 0x416378
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
push 7
pop ecx
lea eax, [ebx - 1]
cmp ecx, eax
mov ecx, esi
push str.bad_pack_level
sbb dl, dl
inc dl
call fcn.00415004
xor edi, edi
add esp, 4
mov dword [esi + 0x6af78], edi
cmp dword [esi + 0x6af70], edi
jne 0x4163c1
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
mov dword [esi + 0x6af6c], edi
push edi
push eax
call fcn.0041e790
movzx eax, word [ebx*8 + 0x444942]
add esp, 0xc
mov dword [esi + 0x6af98], eax
movzx eax, word [ebx*8 + 0x444940]
mov dword [esi + 0x6af9c], eax
movzx eax, word [ebx*8 + 0x444944]
push 2
mov dword [esi + 0x6afa0], eax
movzx eax, word [ebx*8 + 0x444946]
pop ecx
mov dword [esi + 0x6af94], eax
cmp ebx, ecx
jg 0x416424
mov eax, dword [ebp + 8]
or word [eax], 4
jmp 0x41642f
cmp ebx, 8
jl 0x41642f
mov eax, dword [ebp + 8]
or word [eax], cx
push 0x10000
lea ebx, [esi + 0x1af70]
mov dword [esi + 0x6af84], edi
push ebx
push esi
mov dword [esi + 0x6af74], edi
call dword [esi + 0xc]
add esp, 0xc
mov dword [esi + 0x6af90], eax
test eax, eax
je 0x416496
cmp eax, 0xffffffff
je 0x416496
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x416471
mov ecx, esi
call fcn.0041667c
mov dword [esi + 0x6af7c], edi
mov ecx, edi
movzx eax, byte [ebx + edi]
shl ecx, 5
xor ecx, eax
and ecx, 0x7fff
inc edi
mov dword [esi + 0x6af7c], ecx
cmp edi, 2
jb 0x416479
jmp 0x4164a6
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4167c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov ecx, edi
mov ebx, edi
mov dword [ebp - 4], ecx
mov dword [esi + 0x6af80], 2
jmp 0x4169d2
cmp dword [esi + 0x6af90], 3
jb 0x416840
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov eax, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af7c]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x41687d
mov eax, dword [esi + 0x6af84]
sub eax, ecx
cmp eax, 0x7efa
ja 0x41687d
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x416867
mov dword [esi + 0x6afa0], eax
mov edx, ecx
mov ecx, esi
call fcn.004164ab
mov ecx, dword [esi + 0x6af90]
mov ebx, eax
cmp ebx, ecx
cmova ebx, ecx
mov ecx, esi
cmp ebx, 3
jb 0x416960
mov edx, dword [esi + 0x6af84]
lea eax, [ebx - 3]
sub edx, dword [esi + 0x6af88]
push eax
call fcn.00415d59
sub dword [esi + 0x6af90], ebx
pop ecx
mov dword [ebp - 8], eax
cmp ebx, dword [esi + 0x6af98]
ja 0x416916
cmp dword [esi + 0x6af90], 3
jb 0x416916
dec ebx
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [esi + edx + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov eax, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af7c]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
dec ebx
jne 0x4168b9
mov eax, dword [ebp - 8]
jmp 0x41697d
add dword [esi + 0x6af84], ebx
mov dl, 1
mov eax, dword [esi + 0x6af84]
mov ebx, edi
push str.Call_UPDATE_HASH___MIN_MATCH_3_more_times
movzx ecx, byte [eax + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [eax + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
mov ecx, esi
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
call fcn.00415004
mov eax, dword [ebp - 8]
add esp, 4
jmp 0x416983
mov eax, dword [esi + 0x6af84]
xor edx, edx
movzx eax, byte [eax + esi + 0x1af70]
push eax
call fcn.00415d59
dec dword [esi + 0x6af90]
pop ecx
inc dword [esi + 0x6af84]
test eax, eax
je 0x4169bc
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x41699b
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x41699d
mov edx, edi
mov eax, dword [esi + 0x6af84]
sub eax, ecx
mov ecx, esi
push edi
push eax
call fcn.00415bb0
mov eax, dword [esi + 0x6af84]
pop ecx
pop ecx
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x4169cf
mov ecx, esi
call fcn.0041667c
mov ecx, dword [ebp - 4]
cmp dword [esi + 0x6af90], edi
jne 0x4167e5
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x4169f0
lea edi, [esi + 0x1af70]
add edi, ecx
mov eax, dword [esi + 0x6af84]
mov edx, edi
sub eax, ecx
mov ecx, esi
push 1
push eax
call fcn.00415bb0
pop ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4175c9
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4175d4
xor eax, eax
pop ebp
ret
push ebx
push esi
mov esi, dword [ebp + 8]
not ecx
mov ebx, 0xff
cmp esi, 8
jb 0x41768c
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x444540]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x444540]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x444540]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x444540]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x444540]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x444540]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x444540]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x444540]
dec edi
jne 0x4175ef
pop edi
test esi, esi
je 0x4176a5
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x444540]
inc edx
dec esi
jne 0x417690
not ecx
pop esi
mov eax, ecx
pop ebx
pop ebp
ret
Function at 0x41781c
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x44b4b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
xor esi, esi
inc esi
cmp eax, esi
je 0x41785b
mov eax, 0x1000000
jmp 0x4179eb
lea eax, [ebp - 0x38]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x417874
mov eax, 0x200
jmp 0x4179eb
mov eax, dword [ebp - 0x38]
mov edx, eax
push 0
and edx, esi
pop esi
push 1
pop ecx
cmovne esi, ecx
test al, 2
je 0x41788b
or esi, 2
test al, 4
je 0x417892
or esi, 4
mov ecx, eax
and ecx, 0x10
je 0x41789c
or esi, 0x10
test al, 0x20
je 0x4178a3
or esi, 0x20
test ecx, ecx
je 0x4178af
or esi, 0x40000000
jmp 0x4178b5
or esi, 0x80000000
or esi, 0x1000000
test edx, edx
jne 0x4178c5
or esi, 0x800000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x3c], eax
cmp eax, 0x28
jbe 0x417976
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x44]
push eax
push 2
lea eax, [ebp - 0x40]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push 0x24
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x44]
push eax
push 4
lea eax, [ebp - 0x58]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, 0x54ad
cmp word [ebp - 0x40], ax
jne 0x417973
mov ecx, dword [ebp - 0x58]
lea eax, [ecx + 0x34]
cmp dword [ebp - 0x3c], eax
jbe 0x417973
push 0
push 0
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x44]
push eax
push 4
lea eax, [ebp - 0x48]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x48]
cmp eax, 0x5a4d
je 0x41796d
cmp eax, 0x454e
je 0x41796d
cmp eax, 0x454c
je 0x41796d
cmp eax, 0x4550
jne 0x417973
or esi, 0x400000
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x54]
test ecx, ecx
je 0x41797f
mov dword [ecx], esi
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x417988
mov dword [ecx], eax
test edi, edi
je 0x4179c1
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.00417768
push dword [ebp - 0x20]
mov dword [edi], eax
push dword [ebp - 0x24]
mov dword [edi + 4], edx
call fcn.00417768
push dword [ebp - 0x30]
mov dword [edi + 8], eax
push dword [ebp - 0x34]
mov dword [edi + 0xc], edx
call fcn.00417768
add esp, 0x18
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x4179e9
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
movzx ecx, word [ebp - 0x40]
movzx eax, word [ebp - 0x3c]
shl ecx, 0x10
or ecx, eax
mov dword [esi], ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d4e3
mov esp, ebp
pop ebp
ret
Function at 0x417aa5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x417ae1
mov edx, dword [esi + 0x1c]
mov edi, dword [ebp + 0xc]
lea eax, [edx + edi]
cmp eax, dword [esi + 0x20]
jb 0x417acb
mov dword [esi + 0xc], 0x30000
jmp 0x417b06
push edi
push dword [ebp + 8]
add ecx, edx
push ecx
call fcn.0041d660
add esp, 0xc
mov eax, edi
add dword [esi + 0x1c], edi
jmp 0x417b08
mov eax, dword [esi]
test eax, eax
je 0x417aff
push 0
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
jmp 0x417b08
mov dword [esi + 0xc], 0x1000000
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x417d4a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x64]
test ecx, ecx
je 0x417d94
mov eax, dword [edi + 0x6c]
mov esi, dword [edi + 0x68]
cmp eax, esi
jae 0x417dcf
sub esi, eax
cmp esi, dword [ebp + 0xc]
cmova esi, dword [ebp + 0xc]
add eax, ecx
push esi
push eax
push dword [ebp + 8]
call fcn.0041d660
mov edx, dword [ebp + 8]
mov ecx, dword [edi + 0x58]
add dword [edi + 0x6c], esi
add dword [edi + 0x54], esi
push esi
call fcn.004175c9
add esp, 0x10
mov dword [edi + 0x58], eax
mov eax, esi
jmp 0x417dd1
cmp dword [edi + 0x5c], 0
je 0x417dc8
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x5c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x417dcf
mov esi, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov ecx, dword [edi + 0x58]
add dword [edi + 0x54], esi
push esi
call fcn.004175c9
pop ecx
jmp 0x417d8d
mov dword [edi + 0xc], 0x1000000
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x41880b
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x43acc5
call fcn.00422e53
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x40], ebx
je 0x418903
cmp byte [esi + 0x46], bl
je 0x418903
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x418847
xor al, al
jmp 0x418905
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.00408313
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov ebx, edi
cmp eax, 0x10
jae 0x418874
lea ebx, [ebp - 0x28]
mov edi, ebx
mov ecx, dword [esi + 0x40]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, ebx
mov edx, dword [ecx]
push eax
push edi
lea eax, [esi + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x41889b
dec eax
je 0x41889f
dec eax
dec eax
je 0x4188f1
xor bl, bl
jmp 0x4188f3
mov byte [esi + 0x46], 0
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
mov ecx, edi
cmp eax, 0x10
jae 0x4188af
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp - 0x2c]
sub ebx, ecx
je 0x4188d7
cmp eax, 0x10
jae 0x4188be
lea edi, [ebp - 0x28]
push dword [esi + 0x50]
push ebx
push 1
push edi
call fcn.00420624
add esp, 0x10
cmp ebx, eax
jne 0x418897
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
cmp byte [esi + 0x46], 0
je 0x4188f1
test ebx, ebx
jne 0x418868
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.00407787
jmp 0x418862
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040c21e
mov al, bl
jmp 0x418905
mov al, 1
call fcn.00422e02
ret
Function at 0x433c2e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44b4b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00425085
mov dword [ebp - 0x14], eax
cmp dword [0x44e3f0], esi
jne 0x433d21
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x433cae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x433e01
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x433e01
push 0x441a4c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x433e01
push eax
call ebx
push 0x441a58
push edi
mov dword [0x44e3f0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x44e3f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x44e3f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44e400], eax
test eax, eax
je 0x433d1e
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44e3fc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x433d46
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x433d39
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x433d5b
push 4
pop eax
jmp 0x433e03
cmp dword [ebp - 0x14], esi
je 0x433d5b
push dword [0x44e3f0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x433d40
mov eax, dword [0x44e3fc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x433db9
cmp dword [0x44e400], edi
je 0x433db9
push eax
call ebx
push dword [0x44e400]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x433db9
test eax, eax
je 0x433db9
call ecx
test eax, eax
je 0x433dae
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x433dae
test byte [ebp - 8], 1
jne 0x433db9
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x433de9
mov eax, dword [0x44e3f4]
cmp eax, edi
je 0x433de6
push eax
call ebx
test eax, eax
je 0x433de6
call eax
mov esi, eax
test esi, esi
je 0x433de6
mov eax, dword [0x44e3f8]
cmp eax, edi
je 0x433de6
push eax
call ebx
test eax, eax
je 0x433de6
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x44e3f0]
call ebx
test eax, eax
je 0x433e01
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x433e03
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d4e3
mov esp, ebp
pop ebp
ret
Function at 0x404ea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00404a83
push eax
push esi
push dword [ebp + 8]
call fcn.00404a38
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00404a73
cmp al, 0x59
inc eax
cmp ecx, dword [eax - 0x8363]
dec dword [eax - 0x8263]
inc esi
test dword [esi - 1], edi
invalid
Function at 0x405918
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x405931
mov eax, dword [ebp - 4]
jmp 0x405a0b
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x4059e6
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
nop
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x50b0f0]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x50b0f0]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x50b0f0]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x50b0f0]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x50b0f0]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x50b0f0]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x50b0f0]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x50b0f0]
dec ebp
jne 0x405950
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x405a02
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x50b0f0]
dec ecx
jne 0x4059f0
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405a63
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add eax, 3
push 4
shl eax, 4
add eax, ecx
pop ecx
push ebx
push esi
mov dword [ebp + 0xc], ecx
push edi
xor esi, esi
mov edi, eax
mov bl, byte [edi]
xor byte [edx + esi], bl
inc esi
add edi, ecx
cmp esi, ecx
jl 0x405a81
inc eax
add edx, ecx
dec dword [ebp + 0xc]
jne 0x405a7d
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x405d3d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x547240]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edx, ecx
lea edi, [ebp - 0xc]
lea esi, [eax + 4]
mov dword [ebp - 0x1c], 4
movzx eax, byte [edi + 4]
push eax
mov ecx, edx
call fcn.00401500
mov bl, byte [edi - 8]
mov byte [ebp - 0x15], al
movzx eax, byte [edi]
push eax
call fcn.00401500
push ebx
mov byte [ebp - 0x17], al
call fcn.00405bc5
mov bl, al
movzx eax, byte [edi - 4]
push eax
call fcn.00405bdb
xor bl, al
xor bl, byte [ebp - 0x15]
movzx eax, byte [edi - 8]
xor bl, byte [ebp - 0x17]
push eax
mov ecx, edx
mov byte [esi - 4], bl
call fcn.00401500
mov byte [ebp - 0x18], al
movzx eax, byte [edi - 4]
push eax
call fcn.00405bc5
mov bl, al
movzx eax, byte [edi]
push eax
call fcn.00405bdb
xor bl, al
xor bl, byte [ebp - 0x18]
movzx eax, byte [edi - 4]
xor bl, byte [ebp - 0x15]
push eax
mov ecx, edx
mov byte [esi], bl
call fcn.00401500
movzx ebx, byte [edi + 4]
push ebx
mov byte [ebp - 0x15], al
call fcn.00405bdb
mov byte [ebp - 0x16], al
movzx eax, byte [edi]
push eax
mov ecx, edx
call fcn.00405bc5
mov cl, byte [ebp - 0x16]
xor cl, al
xor cl, byte [ebp - 0x15]
movzx eax, byte [edi - 8]
xor cl, byte [ebp - 0x18]
push eax
mov byte [esi + 4], cl
mov ecx, edx
call fcn.00405bdb
push ebx
mov ecx, edx
mov byte [ebp - 0x16], al
call fcn.00405bc5
mov cl, byte [ebp - 0x16]
xor cl, al
xor cl, byte [ebp - 0x15]
xor cl, byte [ebp - 0x17]
inc esi
mov byte [esi + 7], cl
inc edi
dec dword [ebp - 0x1c]
jne 0x405d6b
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004dea60
leave
ret 4