joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c7fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, ecx
push ebp
movzx ebp, word [ebx + 0x74]
lea edx, [ebx + 0x74]
push esi
mov al, byte [ebx + 0x88]
and al, 0x1f
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x34], ebp
push edi
cmp al, 0xe
jne 0x100c7ff8
movzx edx, word [ebx + 0x182]
cmp edx, ebp
jbe 0x100c7ff4
movzx ecx, word [ebx + 0x19a]
cmp ecx, ebp
jbe 0x100c7ff4
nop
cmp ecx, edx
jb 0x100c8174
mov eax, dword [ebx + 0x10]
movzx ecx, word [eax + ecx*8 + 6]
cmp ecx, ebp
ja 0x100c7fe0
mov edx, dword [esp + 0x18]
movzx eax, word [ebx + 0x19c]
cmp eax, ebp
jbe 0x100c817e
mov esi, dword [ebx + 0x10]
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], 0x8000
lea eax, [esi + eax*8]
mov dword [esp + 0x34], eax
movzx eax, word [eax]
movzx ecx, word [esi + eax*8 + 2]
lea ebx, [esi + eax*8]
cmp edx, ebx
je 0x100c8174
movzx edi, word [edx + 2]
cmp byte [esi + edi*8 + 5], 0x1d
lea edx, [esi + edi*8]
jne 0x100c8044
movzx edi, word [edx]
lea edx, [esi + edi*8]
cmp byte [esi + ecx*8 + 5], 0x1d
lea ebp, [esi + ecx*8]
jne 0x100c8055
movzx ecx, word [ebp]
lea ebp, [esi + ecx*8]
mov eax, dword [esp + 0x14]
mov al, byte [eax + 0x79]
mov byte [esp + 0x13], al
cmp al, 0x39
je 0x100c8072
cmp al, 0x38
je 0x100c8072
mov eax, dword [esp + 0x14]
movzx eax, word [eax + 0x74]
jmp 0x100c807e
mov eax, dword [esp + 0x14]
movzx eax, word [eax + 0x74]
movzx eax, word [esi + eax*8]
movzx eax, ax
mov dword [esp + 0x2c], eax
mov al, byte [ebx + 5]
cmp al, 0x39
je 0x100c8095
cmp al, 0x38
je 0x100c8095
movzx eax, word [ebx]
jmp 0x100c809c
movzx eax, word [ebx]
movzx eax, word [esi + eax*8]
movzx ebx, ax
cmp edi, ecx
je 0x100c8143
cmp edi, 0x8000
jae 0x100c80bb
cmp ecx, 0x8000
jb 0x100c815d
cmp byte [esp + 0x13], 0x38
jne 0x100c8139
xor eax, eax
mov dword [esp + 0x1c], edi
cmp byte [edx + 5], 0x28
mov dword [esp + 0x20], eax
jne 0x100c8103
movzx esi, word [edx + 2]
cmp si, word [esp + 0x24]
mov esi, dword [esp + 0x28]
jae 0x100c80ff
movzx eax, word [edx]
mov dword [esp + 0x1c], eax
movzx eax, word [edx + 2]
mov edx, dword [esi + eax*8]
cmp dword [esp + 0x1c], ecx
jne 0x100c80f9
test edx, edx
jne 0x100c815d
mov eax, dword [esp + 0x20]
jmp 0x100c8105
mov edx, eax
jmp 0x100c8105
xor edx, edx
cmp byte [ebp + 5], 0x28
jne 0x100c812d
movzx esi, word [ebp + 2]
cmp si, word [esp + 0x24]
mov esi, dword [esp + 0x28]
jae 0x100c812d
movzx eax, word [ebp + 2]
movzx ecx, word [ebp]
mov eax, dword [esi + eax*8]
cmp edi, ecx
jne 0x100c812d
test eax, eax
jne 0x100c815d
cmp dword [esp + 0x1c], ecx
jne 0x100c8143
cmp edx, eax
je 0x100c8143
jmp 0x100c815d
mov al, byte [ebp + 4]
xor al, byte [edx + 4]
test al, 0x1f
jne 0x100c815d
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x100c8174
push ebx
push eax
push dword [esp + 0x1c]
call fcn.100c88c0
add esp, 0xc
test eax, eax
jne 0x100c8174
mov eax, dword [esp + 0x34]
movzx eax, word [eax + 6]
cmp eax, dword [esp + 0x38]
jbe 0x100c817e
mov edx, dword [esp + 0x18]
jmp 0x100c8016
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2c
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2c
ret
Function at 0x100c8d50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
movzx eax, word [esp + 0xc]
mov ecx, dword [esp + 0x10]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 8], eax
push esi
push edi
movzx eax, word [ebp + eax*2 + 0x11a]
cmp eax, ecx
jbe 0x100c8dc4
mov edi, dword [ebp + 0x10]
mov dl, byte [edi + eax*8 + 4]
lea ebx, [edi + eax*8]
movzx eax, word [ebx]
and dl, 0x1f
cmp eax, ecx
je 0x100c8df1
test dl, dl
jne 0x100c8dbc
cmp word [esp + 0x1c], 0x40
movzx edx, word [edi + eax*8 + 2]
movzx esi, word [edi + ecx*8 + 2]
je 0x100c8da8
mov al, byte [edi + esi*8 + 4]
xor al, byte [edi + edx*8 + 4]
test al, 0x1f
jne 0x100c8dbc
cmp edx, esi
je 0x100c8de9
cmp edx, 0x8000
jae 0x100c8de9
cmp esi, 0x8000
jae 0x100c8de9
movzx eax, word [ebx + 6]
cmp eax, ecx
ja 0x100c8d75
mov eax, dword [esp + 0x10]
movzx eax, word [ebp + eax*2 + 0x10c]
cmp eax, ecx
jbe 0x100c8de9
mov esi, dword [ebp + 0x10]
lea edx, [esi + eax*8]
movzx eax, word [edx]
cmp eax, ecx
je 0x100c8dfe
movzx eax, word [edx + 6]
cmp eax, ecx
ja 0x100c8dd7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
pop edi
xor eax, eax
test dl, dl
pop esi
pop ebp
setne al
pop ebx
pop ecx
ret
test byte [edx + 4], 0x1f
mov eax, 0
pop edi
pop esi
pop ebp
setne al
pop ebx
pop ecx
ret
Function at 0x100f851b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100f81cc

Function at 0x100f8526
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100f8356

Function at 0x101011ac
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10100cff
Function at 0x40aa10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
xor ecx, ecx
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov edx, ecx
sub edx, eax
mov al, byte [edx + edi]
mov byte [ebp + ecx - 0x106], cl
mov byte [ebp + ecx - 0x208], al
inc ecx
cmp ecx, 0x100
jl 0x40aa22
xor eax, eax
lea ebx, [ebx]
movzx ecx, byte [ebp + eax - 0x208]
movzx edx, byte [ebp + eax - 0x106]
add ecx, esi
lea esi, [ecx + edx]
and esi, 0x800000ff
jns 0x40aa85
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [ebp + eax - 0x106]
mov dl, byte [ebp + esi - 0x106]
mov byte [ebp + eax - 0x106], dl
inc eax
mov byte [ebp + esi - 0x106], cl
cmp eax, 0x100
jl 0x40aa60
xor eax, eax
xor cl, cl
mov byte [ebp - 0x107], 0
cmp dword [ebp + 0xc], eax
jbe 0x40ab31
mov edi, dword [ebp + 8]
push ebx
jmp 0x40aac6
mov cl, byte [ebp - 0x108]
mov dl, byte [eax + edi]
inc cl
mov byte [ebp - 0x108], cl
movzx esi, cl
movzx ebx, byte [ebp + esi - 0x106]
movzx ecx, byte [ebp - 0x107]
add ecx, ebx
mov byte [ebp - 0x107], cl
movzx ebx, byte [ebp + esi - 0x106]
movzx ecx, cl
lea ecx, [ebp + ecx - 0x106]
mov byte [ebp - 1], bl
movzx ebx, byte [ecx]
mov byte [ebp + esi - 0x106], bl
movzx ebx, byte [ebp - 1]
mov byte [ecx], bl
movzx ebx, byte [ebp + esi - 0x106]
add bl, byte [ecx]
inc eax
movzx ecx, bl
mov cl, byte [ebp + ecx - 0x106]
xor cl, dl
mov byte [eax + edi - 1], cl
cmp eax, dword [ebp + 0xc]
jb 0x40aac0
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40b940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x77
push esi
mov dword [ebp - 0x20], 0x6f726863
mov dword [ebp - 0x1c], 0x635f656d
mov dword [ebp - 0x18], 0x646c6968
mov dword [ebp - 0x14], 0x6c6c642e
mov byte [ebp - 0x10], 0
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
call fcn.00409c10
add esp, 8
test eax, eax
jne 0x40b9a3
lea eax, [ebp - 0x20]
push eax
lea ecx, [esi + 0x1c]
push ecx
call fcn.0040acf0
add esp, 8
test eax, eax
je 0x40ba2e
push ebx
push edi
push eax
push esi
call fcn.00406b10
mov edx, dword [esi + 0xca0]
push 0x15db1ddc
push 0
push 0
mov edi, eax
push edx
lea eax, [esi + 0xc94]
push eax
call fcn.00414e50
add esp, 0x1c
mov ebx, eax
call fcn.0041f1aa
mov dword [eax + 3], esi
call fcn.0041f1bc
mov dword [eax + 3], esi
test edi, edi
je 0x40ba01
push 1
push 2
call fcn.0041f1aa
add eax, 2
push eax
lea ecx, [esi + 0x1934]
push ecx
push edi
push esi
call fcn.004055a0
add esp, 0x18
test ebx, ebx
je 0x40ba23
push 0
push 0
call fcn.0041f1bc
add eax, 2
push eax
lea edx, [esi + 0x19b4]
push edx
push ebx
push esi
call fcn.004055a0
add esp, 0x18
push esi
call fcn.004175e0
add esp, 4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x6b02e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x259000]
push edi
jmp 0x6b02fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6b0301
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6b02f0
mov eax, 1
add ebx, ebx
jne 0x6b0313
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6b0324
jne 0x6b0343
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6b0343
dec eax
add ebx, ebx
jne 0x6b0330
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6b0308
add ebx, ebx
jne 0x6b033f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6b0395
xor ecx, ecx
sub eax, 3
jb 0x6b035b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6b03ca
sar eax, 1
mov ebp, eax
jmp 0x6b0366
add ebx, ebx
jne 0x6b0366
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6b0334
inc ecx
add ebx, ebx
jne 0x6b0374
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6b0334
add ebx, ebx
jne 0x6b0381
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6b0376
jne 0x6b0392
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6b0376
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6b03b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6b03a6
jmp 0x6b02f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6b03b4
add edi, ecx
jmp 0x6b02f6
pop esi
mov edi, esi
mov ecx, 0x3ea9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6b03d2
cmp byte [edi], 0x11
jne 0x6b03d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6b03d7
lea edi, [esi + 0x2a9000]
mov eax, dword [edi]
or eax, eax
je 0x6b044f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x487cb0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x487e2c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6b0404
mov ecx, edi
jns 0x6b0433
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x487e30]
or eax, eax
je 0x6b0449
mov dword [ebx], eax
add ebx, 4
jmp 0x6b0421
call dword [esi + 0x487e40]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x6b0480
cmp al, 0xef
ja 0x6b0473
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x6b0455
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x6b0462
mov ebp, dword [esi + 0x487e34]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6b04b4
sub esp, 0xffffff80
jmp 0x42800a
Function at 0x40d5b8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040803b
mov dword [ebp - 0x14], eax
cmp dword [0x4ad500], esi
jne 0x40d6ab
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d638
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d78b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d78b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d78b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4ad500], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4ad504], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4ad508], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ad510], eax
test eax, eax
je 0x40d6a8
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ad50c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d6d0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d6c3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d6e5
push 4
pop eax
jmp 0x40d78d
cmp dword [ebp - 0x14], esi
je 0x40d6e5
push dword [0x4ad500]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d6ca
mov eax, dword [0x4ad50c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d743
cmp dword [0x4ad510], edi
je 0x40d743
push eax
call ebx
push dword [0x4ad510]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d743
test eax, eax
je 0x40d743
call ecx
test eax, eax
je 0x40d738
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d738
test byte [ebp - 8], 1
jne 0x40d743
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d773
mov eax, dword [0x4ad504]
cmp eax, edi
je 0x40d770
push eax
call ebx
test eax, eax
je 0x40d770
call eax
mov esi, eax
test esi, esi
je 0x40d770
mov eax, dword [0x4ad508]
cmp eax, edi
je 0x40d770
push eax
call ebx
test eax, eax
je 0x40d770
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4ad500]
call ebx
test eax, eax
je 0x40d78b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d78d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040433c
mov esp, ebp
pop ebp
ret
Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.00401485
lea eax, [ebp - 0x404]
push eax
call fcn.00401485
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b66
leave
ret

Function at 0x401485
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x401494
pop dword [ebp - 0x28]
mov eax, 0x71f685b
sub eax, 0x6df53c7
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x7c6fe6a7
sub dword [ebp - 0x38], 0x2e1da15c
mov dword [ebp - 0x34], 0x1b1dfdbd
add dword [ebp - 0x34], 0x17154e88
mov dword [ebp - 0x30], 0x55571569
sub dword [ebp - 0x30], 0x90ad13b
mov dword [ebp - 0x2c], 0x4a643831
add dword [ebp - 0x2c], 0xb59bc7cf
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xcf4794cf
sub dword [ebp - 0x38], 0x5ad52b79
mov dword [ebp - 0x34], 0x98822ae1
sub dword [ebp - 0x34], 0x5715c96c
mov dword [ebp - 0x30], 0x5e12eb4f
sub dword [ebp - 0x30], 0xfaa37ee3
mov dword [ebp - 0x2c], 0xe0c877c0
add dword [ebp - 0x2c], 0x1f378840
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x4d7d89cc
add eax, 0xb2c3467c
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3ea71
push 0
call eax
mov ecx, 0xb0b33c7c
add ecx, 0x4f4d1fb5
mov esi, eax
mov edi, 0x41b000
add edi, dword [ebp - 0x28]
mov edx, 0xee8b20
add edx, 0xb9d174dd
xor dword [ebp - 8], 0xd47721c6
mov ebx, dword [edi]
add dword [ebp - 8], 0xd4a66cda
sub ebx, edx
xor dword [ebp - 0x24], 0x332c2365
mov dword [esi], ebx
mov dword [ebp - 0x24], 0x806c0e1e
add esi, 0xeecf2ca6
sub esi, 0xeecf2ca2
add edi, 0x84b345c4
sub edi, 0x84b345c0
loop 0x4015ab
add eax, 0xeaf44a99
sub eax, 0xeaf2e702
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x407ef0
Capabilities:
Encode data using xor

Disassembly:
push edx
call 0x407ef0
sbb dword [0x90c35d1c], 0xffffff90
nop
nop
nop
nop
nop
nop
nop
push ebp
add ebp, esp
sub bh, 0x14
cmp dword [ebp + 0x10], 0x4f
adc al, 0x83
jge 0x407f09
dec edi
jl 0x407f03
fild word [ebp - 0x18]
dec esi
mov byte [0x45dd0015], al
or ah, bl
sbb eax, 0x40c230
fld qword [ebp + 8]
fcomp qword [0x40c230]
xor dl, al
inc eax
add byte [ebp - 0x74acfdb3], bh
ret 0x40
mov ebp, 0x8b53024d
pop ebp
and byte [esi - 0xe], dl
pop es
push edi
fnstsw ax
mov dword [ebp - 4], esi
mov dword [ecx], esi
test ah, 5
or eax, 0xdd0e7ac8
inc ebp
or cl, bl
loopne 0x407f08
pop ebp
mov ebp, 0x680101c7
aam 0xe8
mov ecx, dword [ebp - 0x4b]
mov edx, dword [ebp + 8]
lea eax, [ebx]
in al, dx
push eax
sub byte [edx - 1], dl
adc eax, 0x25c118
fstp qword [ebp + 8]
fucom st(2)
in al, dx
fcomp qword [0x406fb3]
ffree st(4)
stosd dword es:[edi], eax
fild qword [ebx - 0x2bb200a]
jb 0x407ee9
jae 0x407ef5
cmp esi, ebx
jbe 0x407f31
fld qword [esp + ebp*8]
fsubr st(1), st(0)
arpl word [edx + 0x40], sp
add byte [ecx + 0x44c4f6e0], dh
dec byte [eax + 0x6d]
inc ebp
in al, dx
fsubr st(1), st(0)
adc bl, al
inc eax
lea eax, [ebp - 0x14]
push eax
das
in al, dx
or ch, bl
sbb al, 0x24
ret 0x1815
Function at 0x4013b2
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x34], edi
mov eax, dword [edi]
mov ebx, dword [edi + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [0x41a318]
mov dword [ebp - 0x24], eax
mov eax, dword [0x41a31c]
mov dword [ebp - 0x2c], eax
call fcn.004013ab
mov esi, dword [ebp - 0x10]
mov ecx, dword [0x41a320]
add esi, 0x23f
mov eax, dword [0x41a324]
push 0x20
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x20], eax
pop edi
mov dword [ebp - 0x18], 2
add dword [ebp - 0x18], 3
mov edx, dword [ebp - 0x14]
mov eax, edx
shl eax, 4
add eax, ecx
mov dword [ebp - 0x1c], 0xedeb2e40
cmp dword [0x48db68], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x48db64]
cmove eax, dword [ebp - 0x1c]
and dword [ebp - 0x1c], 0
cmp dword [0x48db68], 0x3eb
mov dword [0x48db64], eax
mov eax, dword [0x48d5f0]
cmove eax, dword [ebp - 0x1c]
mov dword [0x48d5f0], eax
lea eax, [esi + edx]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 4]
sub ebx, eax
mov dword [ebp - 8], eax
mov eax, ebx
mov dword [0x48db60], 0xf4ea3dee
shl eax, 4
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
nop
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
mov eax, ebx
shr eax, cl
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0x1c]
cmp dword [0x48db68], 0xb03
mov dword [ebp - 4], eax
jne 0x4014df
push str.focomonebizihaxinecarimecuweguzubelimibezavotacaxariyetanovuvecogoyifikoxawivikasimuruwudoxasofuye
push edx
push edx
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x30]
add esi, 0x61c88647
mov dword [ebp - 0x10], esi
dec edi
jne 0x401404
mov edi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov dword [edi + 4], ebx
mov dword [edi], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d337
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407aeb
mov dword [ebp - 0x14], eax
cmp dword [0x4482fc], esi
jne 0x40d42a
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d3b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d50a
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d50a
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d50a
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4482fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x448300], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x448304], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44830c], eax
test eax, eax
je 0x40d427
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x448308], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d44f
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d442
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d464
push 4
pop eax
jmp 0x40d50c
cmp dword [ebp - 0x14], esi
je 0x40d464
push dword [0x4482fc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d449
mov eax, dword [0x448308]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d4c2
cmp dword [0x44830c], edi
je 0x40d4c2
push eax
call ebx
push dword [0x44830c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d4c2
test eax, eax
je 0x40d4c2
call ecx
test eax, eax
je 0x40d4b7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d4b7
test byte [ebp - 8], 1
jne 0x40d4c2
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d4f2
mov eax, dword [0x448300]
cmp eax, edi
je 0x40d4ef
push eax
call ebx
test eax, eax
je 0x40d4ef
call eax
mov esi, eax
test esi, esi
je 0x40d4ef
mov eax, dword [0x448304]
cmp eax, edi
je 0x40d4ef
push eax
call ebx
test eax, eax
je 0x40d4ef
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4482fc]
call ebx
test eax, eax
je 0x40d50a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d50c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404010
mov esp, ebp
pop ebp
ret