joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452afc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x46c580]
cmp dword [eax + 0x30], 0
je 0x452ba6
cmp dword [ebx + 0x94], 0
jne 0x452ba0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x452a8c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x452ba0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x452b66
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x452ba0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004175ac
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x452b75
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4538c0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4538f5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040475c
jmp 0x453902
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004046c0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x454c64
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x454cd2
mov eax, esi
call fcn.0043f63c
test al, al
je 0x454cd2
mov eax, dword [ebx + 0x84]
call fcn.0043f340
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x454cd2
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x454cc6
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043f340
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00437884
jmp 0x454cd2
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00454aa0
pop esi
pop ebx
ret
Function at 0x40bb8e
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x44f6b0], 0
je 0x40bb9b
or eax, 0xffffffff
ret
mov eax, dword [0x43f58c]
push ebx
push ebp
xor ebp, ebp
cmp eax, ebp
jg 0x40bbd9
mov ecx, dword [0x43f588]
jl 0x40bbb4
cmp ecx, ebp
ja 0x40bbd9
or ebx, 0xffffffff
mov dword [0x44f5d0], ebp
add ecx, ebx
mov dword [0x44f5d4], ebp
mov dword [0x43f588], ecx
adc eax, ebx
mov dword [0x43f58c], eax
mov eax, ebx
jmp 0x40bce3
push esi
push edi
mov edi, dword [0x44f5d4]
or ebx, 0xffffffff
cmp edi, ebp
jg 0x40bc3e
jl 0x40bbf4
mov esi, dword [0x44f5d0]
cmp esi, ebp
ja 0x40bc44
mov esi, 0x2000
push esi
push dword [0x44f5c4]
call fcn.0040bebd
cdq
mov ecx, eax
mov dword [0x44f5d0], eax
or ecx, edx
mov dword [0x44f5d4], edx
je 0x40bc80
and eax, edx
cmp eax, ebx
je 0x40bc71
add dword [0x44f608], esi
mov eax, dword [0x44f5c4]
adc dword [0x44f60c], ebp
mov dword [0x44f5c8], eax
call fcn.0040b5ba
mov edi, dword [0x44f5d4]
mov esi, dword [0x44f5d0]
mov eax, dword [0x43f5b8]
test byte [eax + 0x70], 1
je 0x40bcc3
cmp byte [0x45076d], 0
mov eax, esi
je 0x40bc90
or eax, edi
je 0x40bcc3
push esi
push dword [0x44f5c8]
push 0x450778
call fcn.0040f55b
jmp 0x40bcb7
push 0x46601a
mov ecx, 0x45bdac
call fcn.00401a13
mov dword [0x44f5d0], ebp
mov eax, ebx
mov dword [0x44f5d4], ebp
jmp 0x40bce1
or eax, edi
mov ebp, dword [0x44f5c8]
je 0x40bcc3
add esi, ebx
adc edi, ebx
call fcn.0040f326
xor byte [ebp], al
movzx eax, byte [ebp]
push eax
call fcn.0040f44d
mov eax, esi
inc ebp
or eax, edi
jne 0x40bc9a
mov esi, dword [0x44f5d0]
mov edi, dword [0x44f5d4]
mov eax, dword [0x44f5c8]
add esi, ebx
mov dword [0x44f5d0], esi
adc edi, ebx
mov dword [0x44f5d4], edi
movzx eax, byte [eax]
inc dword [0x44f5c8]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x40f387
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x43565c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push eax
call fcn.0040f344
push 0xc
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00417d40
add esp, 0xc
xor esi, esi
call fcn.0040f326
xor byte [ebp + esi - 0x10], al
movzx eax, byte [ebp + esi - 0x10]
push eax
call fcn.0040f44d
inc esi
cmp esi, 0xc
jl 0x40f3b5
mov eax, dword [0x43f5b8]
movzx edx, byte [ebp - 5]
movzx ecx, byte [0x44f627]
test byte [eax + 0x70], 2
jne 0x40f3ec
movzx ecx, byte [0x44f62f]
cmp edx, ecx
je 0x40f3f5
or eax, 0xffffffff
jmp 0x40f43e
cmp byte [ebp + 0x10], 0
je 0x40f43c
mov ecx, dword [0x44f5d0]
mov eax, ecx
cdq
cmp edx, dword [0x43f58c]
jl 0x40f418
mov esi, dword [0x43f588]
jg 0x40f41a
cmp eax, esi
ja 0x40f41a
mov esi, ecx
push edi
mov edi, dword [0x44f5c8]
test esi, esi
je 0x40f43b
call fcn.0040f326
xor byte [edi], al
movzx eax, byte [edi]
push eax
call fcn.0040f44d
inc edi
sub esi, 1
jne 0x40f425
pop edi
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00416559
leave
ret 0xc
Function at 0x40f44d
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [0x4506f0]
mov eax, dword [esp + 4]
mov edx, dword [0x4506f8]
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x43f160]
movzx eax, cl
add eax, dword [0x4506f4]
mov dword [0x4506f0], ecx
imul ecx, eax, 0x8088405
mov eax, dword [esp + 4]
inc ecx
mov dword [0x4506f4], ecx
shr ecx, 0x18
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [ecx*4 + 0x43f160]
mov dword [0x4506f8], edx
ret 4

Function at 0x40f691
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov eax, dword [0x43565c]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x38]
push esi
mov esi, dword [esp + 0x40]
push edi
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
push ebx
mov dword [esp + 0x18], esi
call fcn.0040fa30
test ebp, ebp
je 0x40f6de
cmp byte [esi], 0
je 0x40f6de
push 0x18
pop ecx
mov esi, ebp
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x10]
jmp 0x40f702
lea edi, [ebx + 0x60]
push 0x40
mov eax, edi
pop ecx
xor byte [eax], 0x6a
inc eax
sub ecx, 1
jne 0x40f6e6
push ebx
call fcn.00406b20
push 0x40
push edi
push ebx
call fcn.00406b51
test ebp, ebp
je 0x40f717
cmp byte [esi], 0
jne 0x40f717
mov eax, dword [esp + 0x10]
mov esi, ebx
push 0x18
pop ecx
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov byte [eax], 1
push 0x14
lea eax, [esp + 0x1c]
push eax
push ebx
call fcn.00406b51
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.0040fa30
cmp dword [esp + 0x3c], 0
pop edi
pop esi
pop ebp
pop ebx
jbe 0x40f74f
push dword [esp + 0x2c]
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
call fcn.00417d40
add esp, 0xc
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00416559
add esp, 0x20
ret 0x14

Function at 0x40f760
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
lea ebx, [esi + 0x60]
cmp edi, 0x40
jbe 0x40f790
push esi
call fcn.00406b20
push edi
push dword [esp + 0x18]
push esi
call fcn.00406b51
push ebx
push esi
call fcn.0040fa30
push 0x14
pop edi
jmp 0x40f79e
push edi
push dword [esp + 0x18]
push ebx
call fcn.00417d40
add esp, 0xc
mov dword [esi + 0xa0], edi
test edi, edi
je 0x40f7c0
push 0xffffffffffffffa0
pop edx
mov ecx, ebx
sub edx, esi
xor byte [ecx], 0x36
inc ecx
mov edi, dword [esi + 0xa0]
lea eax, [edx + ecx]
cmp eax, edi
jb 0x40f7af
push 0x40
pop eax
sub eax, edi
push eax
lea eax, [esi + 0x60]
add eax, edi
push 0x36
push eax
call fcn.00417690
add esp, 0xc
push esi
call fcn.00406b20
push 0x40
push ebx
push esi
call fcn.00406b51
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x411d72
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ecx
push esi
push edi
push 0x42b4ac
push dword [esp + 0x18]
push dword [0x457d84]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x411e8b
push esi
push dword [0x457d84]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x411e8b
push esi
push dword [0x457d84]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x411e8b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x411e8b
push ebx
push ebp
push edi
xor ebp, ebp
push 2
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x411e83
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x411e7c
push edi
push esi
push eax
call fcn.00417d40
add esp, 0xc
mov dword [esp + 0x10], ebp
lea eax, [esp + 0x10]
push eax
push ebp
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x411e75
push ebp
push dword [esp + 0x14]
call fcn.00411cd6
mov ecx, dword [esp + 0x10]
mov edi, eax
push ecx
mov edx, dword [ecx]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x42a230]
call esi
test edi, edi
je 0x411e75
mov eax, dword [edi + 8]
mov dword [edi + 8], ebp
test eax, eax
jne 0x411e63
push 0xffffff
lea eax, [esp + 0x18]
push eax
push dword [edi + 4]
call sub.gdiplus.dll_GdipCreateHBITMAPFromBitmap
test eax, eax
je 0x411e63
mov dword [edi + 8], eax
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x42a230]
mov ecx, edi
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x14]
pop ebp
pop ebx
jmp 0x411e8d
xor eax, eax
pop edi
pop esi
pop ecx
pop ecx
ret 4

Function at 0x412636
Capabilities:
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0xfa8]
mov eax, 0x1028
call fcn.00416600
mov eax, dword [0x43565c]
xor eax, ebp
mov dword [ebp + 0xfa4], eax
cmp word [0x458d92], 0
je 0x4126e7
push esi
push 6
push dword [0x435604]
mov esi, 0x458d92
push esi
call fcn.00404029
push eax
call fcn.0040856e
test eax, eax
jne 0x4126e6
push 0x457d90
call fcn.004122d8
push 0x800
push esi
lea eax, [ebp - 0x60]
push eax
call fcn.00407077
lea eax, [ebp - 0x60]
push eax
call fcn.0041b233
pop ecx
lea eax, [eax*2 + 2]
cmp eax, 0x1002
jae 0x4126fc
xor ecx, ecx
push 0x1e
mov word [ebp + eax - 0x60], cx
lea eax, [ebp - 0x80]
push ecx
push eax
call fcn.00417690
add esp, 0xc
mov dword [ebp - 0x7c], 3
push 0x14
pop eax
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
pop esi
mov ecx, dword [ebp + 0xfa4]
xor ecx, ebp
call fcn.00416559
add ebp, 0xfa8
leave
ret
call fcn.004167a5
int3
Function at 0x412758
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x43565c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x43561c], 0
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, 0x400
push edi
mov edi, dword [ebp + 0x14]
jne 0x4127b3
push 0x64
lea eax, [ebp - 0x130]
push eax
push 0xf
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [ebp - 0x130]
mov word [0x46824c], ax
xor eax, eax
mov word [0x46824e], ax
mov dword [0x43561c], 0x46824c
push 0x32
lea eax, [ebp - 0x68]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406f0e
push edi
push esi
xor eax, eax
push 0x43560c
mov word [esi], ax
lea eax, [ebp - 0x68]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov ecx, dword [ebp - 4]
xor eax, eax
mov word [esi + edi*2 - 2], ax
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00416559
leave
ret 0x10

Function at 0x4152f8
Capabilities:
Hide graphical window

Disassembly:
and dword [0x457d8c], 0
push 1
push dword [esp + 8]
mov byte [0x450965], 1
mov byte [0x450966], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.004011b3
cmp dword [0x468238], 0
jne 0x415338
cmp byte [0x450973], 0
je 0x415341
cmp dword [0x45096c], 0
jne 0x415354
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x4154d0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.00416600
mov eax, dword [0x43565c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push esi
call fcn.00406d80
mov esi, eax
test esi, esi
je 0x415531
movzx ecx, word [esi]
push ecx
jmp 0x41551c
add esi, 2
movzx eax, word [esi]
push eax
call fcn.00406e9c
test al, al
jne 0x415515
push esi
push str.sfxpar
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00416559
leave
ret 4
Function at 0xaab4f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4bf000]
push edi
or ebp, 0xffffffff
jmp 0xaab512
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xaab519
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xaab508
mov eax, 1
add ebx, ebx
jne 0xaab52b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xaab53c
jne 0xaab55b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xaab55b
dec eax
add ebx, ebx
jne 0xaab548
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xaab520
add ebx, ebx
jne 0xaab557
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xaab5ad
xor ecx, ecx
sub eax, 3
jb 0xaab573
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xaab5e2
sar eax, 1
mov ebp, eax
jmp 0xaab57e
add ebx, ebx
jne 0xaab57e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xaab54c
inc ecx
add ebx, ebx
jne 0xaab58c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xaab54c
add ebx, ebx
jne 0xaab599
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xaab58e
jne 0xaab5aa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xaab58e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xaab5cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xaab5be
jmp 0xaab50e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xaab5cc
add edi, ecx
jmp 0xaab50e
pop esi
mov edi, esi
mov ecx, 0x24ca0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xaab5ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xaab5ef
lea edi, [esi + 0x6a7000]
mov eax, dword [edi]
or eax, eax
je 0xaab657
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6b5244]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6b5368]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xaab615
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6b5370]
or eax, eax
je 0xaab651
mov dword [ebx], eax
add ebx, 4
jmp 0xaab632
call dword [esi + 0x6b536c]
mov ebp, dword [esi + 0x6b5374]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xaab68b
sub esp, 0xffffff80
jmp 0x85ea4c
Function at 0x410310
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb000]
push edi
jmp 0x41032a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x410331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x410320
mov eax, 1
add ebx, ebx
jne 0x410343
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x410338
jne 0x410354
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x410338
xor ecx, ecx
sub eax, 3
jb 0x410368
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4103da
mov ebp, eax
add ebx, ebx
jne 0x410373
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x410380
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4103a4
inc ecx
add ebx, ebx
jne 0x410390
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x410385
jne 0x4103a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x410385
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4103c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4103b5
jmp 0x410326
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4103c4
add edi, ecx
jmp 0x410326
pop esi
mov edi, esi
mov ecx, 0x172
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4103e2
cmp byte [edi], 1
jne 0x4103e2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4103e7
lea edi, [esi + 0xe000]
mov eax, dword [edi]
or eax, eax
je 0x41045f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x137f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x13898]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x410414
mov ecx, edi
jns 0x410443
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1389c]
or eax, eax
je 0x410459
mov dword [ebx], eax
add ebx, 4
jmp 0x410431
call dword [esi + 0x138ac]
mov ebp, dword [esi + 0x138a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x410493
sub esp, 0xffffff80
jmp 0x40790e
Function at 0x4010d0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x424d78]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
push ecx
push 0xff
lea edx, [ebp - 0x204]
push 0x100
push edx
call fcn.0040d660
xor eax, eax
add esp, 0x14
lea ecx, [ebp - 0x204]
mov word [ebp - 6], ax
mov dword [ebp - 0x208], ecx
cmp dword [esi + 0x260], eax
jne 0x40112d
mov edx, ecx
push edx
call fcn.0040d309
add esp, 4
add esi, 0x40
push esi
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x401162
push 0
lea eax, [ebp - 0x208]
push eax
push 0
push 1
push 0
push 0
push 0
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040d680
mov esp, ebp
pop ebp
ret

Function at 0x40173d
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x401778
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40175f
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x401770
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x40177a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x401755
xor eax, eax
pop edi
pop esi
ret

Function at 0x401940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov bh, 0xd0
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x401951
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x401942
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.004016fd
lodsb al, byte [esi]
or eax, 0x458d26b1
test al, 0x50
call fcn.0040170d
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.004016c2
add esp, 0x10
lea ecx, [ebp - 0xb0]
push eax
invalid
invalid
call dword [ecx - 1]
ror byte [ebx - 0x727407bb], 1
push esp
invalid
invalid
push dword [ebx]
sal bh, cl
int1
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x4019eb
inc dword [ebp - 0x8c]
invalid
scasd eax, dword es:[edi]
invalid
je 0x4019ef
Function at 0x401a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
rol esi, cl
inc ebp
stc
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.0040170d
push eax
push esi
push dword [ebp + 8]
call fcn.004016c2
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040170d
push eax
push esi
push dword [ebp + 8]
call fcn.004016c2
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x401b98
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040170d
push eax
push esi
push dword [ebp + 8]
call fcn.004016c2
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004016fd
loope 0x401bc9
xchg ebp, eax
pop ecx
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
inc ebp
invalid