joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4116b0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426f56
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x238], 0
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21c]
cmp word [ebp - 0x21c], 0
je 0x411759
jmp 0x411750
add eax, 2
cmp word [eax], 0
jne 0x411750
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x234]
call fcn.0040a4e0
push str.ChangZhi2
lea edx, [ebp - 0x234]
mov dword [ebp - 4], 1
mov ecx, 0x441394
call fcn.00413be0
add esp, 4
cmp dword [ebp - 0x220], 8
jb 0x4117a3
push dword [ebp - 0x234]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, 0x441394
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00424ad0
mov esp, ebp
pop ebp
ret 4

Function at 0x411870
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426fbb
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x224], 0
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
mov dword [ebp - 0x220], 0x4413b0
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [0x4413c4], 7
mov dword [0x4413c0], 0
mov word [0x4413b0], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x21c]
cmp word [ebp - 0x21c], 0
je 0x41191a
add eax, 2
cmp word [eax], 0
jne 0x411911
push eax
lea eax, [ebp - 0x21c]
mov ecx, 0x4413b0
push eax
call fcn.0040a4e0
mov eax, 0x4413b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00424ad0
mov esp, ebp
pop ebp
ret 4
Function at 0x414e90
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x302c
call fcn.004256c0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xorps xmm0, xmm0
mov dword [ebp - 0x300c], 0
lea eax, [ebp - 0x302c]
mov esi, edx
push eax
mov edi, ecx
movdqu xmmword [ebp - 0x302c], xmm0
movdqu xmmword [ebp - 0x301c], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x3018]
mov dword [edi], eax
mov dword [esi], eax
mov eax, dword [0x441434]
test al, 1
jne 0x414f13
push str.GetLogicalProcessorInformation
or eax, 1
push str.kernel32.dll
mov dword [0x441434], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [0x441438], esi
jmp 0x414f19
mov esi, dword [0x441438]
test esi, esi
je 0x414f87
push 0x3000
lea eax, [ebp - 0x3004]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x3008], 0x3000
lea eax, [ebp - 0x3008]
push eax
lea eax, [ebp - 0x3004]
push eax
call esi
test eax, eax
je 0x414f87
mov eax, 0xaaaaaaab
xor esi, esi
mul dword [ebp - 0x3008]
shr edx, 4
test edx, edx
je 0x414f87
lea ecx, [ebp - 0x3000]
jmp 0x414f70
mov eax, dword [ecx]
sub eax, 0
je 0x414f7a
dec eax
jmp 0x414f7b
inc esi
add ecx, 0x18
dec edx
jne 0x414f70
test esi, esi
je 0x414f87
mov dword [edi], esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00424ad0
mov esp, ebp
pop ebp
ret
Function at 0x416770
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x427dc8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x4168f7
cmp byte [edi + 0x45], 0
je 0x4168f7
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x4167d0
xor al, al
jmp 0x4168f9
sub esp, 8
lea ecx, [esp + 0x20]
call fcn.00417720
mov dword [esp + 0x40], 0
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x1c]
cmp ebx, 0x10
lea ecx, [esp + 0x1c]
cmovae ecx, dword [esp + 0x1c]
cmovae edx, dword [esp + 0x1c]
add eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x40]
lea eax, [edi + 0x48]
push eax
call dword [sym.imp.MSVCP120.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x41682f
dec eax
je 0x416833
sub eax, 2
je 0x4168dd
xor bl, bl
jmp 0x4168df
mov byte [edi + 0x45], 0
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x18]
cmp ebx, 0x10
mov esi, dword [esp + 0x14]
cmovae eax, ecx
sub esi, eax
je 0x41686b
push dword [edi + 0x50]
cmp ebx, 0x10
lea eax, [esp + 0x1c]
push esi
cmovae eax, ecx
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x416828
cmp byte [edi + 0x45], 0
je 0x4168dd
test esi, esi
jne 0x4167e4
mov ecx, dword [esp + 0x28]
or eax, 0xffffffff
sub eax, ecx
cmp eax, 8
jbe 0x4168d2
lea esi, [ecx + 8]
push ecx
push esi
lea ecx, [esp + 0x20]
call fcn.00403ac0
test al, al
je 0x4167e4
cmp dword [esp + 0x2c], 0x10
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x28]
xorps xmm0, xmm0
cmovae ecx, dword [esp + 0x18]
movq qword [ecx + eax], xmm0
lea eax, [esp + 0x18]
cmp dword [esp + 0x2c], 0x10
mov dword [esp + 0x28], esi
cmovae eax, dword [esp + 0x18]
mov byte [eax + esi], 0
jmp 0x4167e4
push str.string_too_long
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xlength_error_char_const__]
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x4168f3
push dword [esp + 0x18]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
jmp 0x4168f9
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00424ad0
mov esp, ebp
pop ebp
ret
Function at 0x41b790
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, edx
mov esi, ecx
cmp dword [edi + 0x14], 8
jb 0x41b7b3
mov eax, dword [edi]
jmp 0x41b7b5
mov eax, edi
cmp dword [esi + 0x14], 8
jb 0x41b7bd
mov ecx, dword [esi]
push 1
push 0
push eax
push ecx
push str.shell_filename____s___param____s___runas___d__show___d
call fcn.0041d710
push 0x118
lea eax, [ebp - 0x124]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0x20
mov dword [ebp - 0x128], 0x11c
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x41b815
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [edi + 0x14], 8
jb 0x41b81d
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x41b825
mov esi, dword [esi]
push 5
push 0
push edi
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x41b863
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.shellEx_failed____lastError___d
call fcn.0041d710
add esp, 8
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00424ad0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00424ad0
mov esp, ebp
pop ebp
ret
Function at 0x41b880
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4282a8
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
cmp dword [esi + 0x14], 8
jb 0x41b8bb
mov eax, dword [esi]
jmp 0x41b8bd
mov eax, esi
cmp dword [edi + 0x14], 8
jb 0x41b8c5
mov ecx, dword [edi]
push eax
push ecx
push str.createProcess_filename____s___param____s_
call fcn.0041d710
push edi
mov edx, 0x42cbf0
lea ecx, [ebp - 0x40]
call fcn.0040a1d0
push 0x42cbf0
mov edx, eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0040a2c0
add esp, 0x14
mov byte [ebp - 4], 2
cmp dword [ebp - 0x2c], 8
mov edi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x41b910
push dword [ebp - 0x40]
call edi
add esp, 4
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
cmp dword [esi + 0x10], eax
je 0x41b95d
push esi
mov edx, 0x42c690
lea ecx, [ebp - 0x58]
call fcn.0040a1d0
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.004040b0
mov byte [ebp - 4], 2
cmp dword [ebp - 0x44], 8
jb 0x41b95d
push dword [ebp - 0x58]
call edi
add esp, 4
push 0x40
lea eax, [ebp - 0xac]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0xb0], 0x44
lea ecx, [ebp - 0x68]
mov dword [ebp - 0xac], 0
xor eax, eax
mov dword [ebp - 0xa8], 0
cmp dword [ebp - 0x14], 8
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x80], eax
push ecx
push 0
push 0
push 0x10
push 0
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push 0
push eax
push 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x84], 1
movdqu xmmword [ebp - 0x68], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x41b9f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.createProcess_failed____lastError___d
call fcn.0041d710
add esp, 8
xor esi, esi
jmp 0x41ba05
push dword [ebp - 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x68]
cmp dword [ebp - 0x14], 8
jb 0x41ba13
push dword [ebp - 0x28]
call edi
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424ad0
mov esp, ebp
pop ebp
ret
Function at 0x41e770
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.004256c0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0x1008], edx
push 0x7fe
push eax
mov word [ebp - 0x804], ax
mov ebx, ecx
lea eax, [ebp - 0x802]
mov dword [ebp - 0x100c], 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x41e7ec
lea eax, [ebp - 0x804]
push 0x5c
push eax
call dword [sym.imp.MSVCR120.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x41e7ec
xor ecx, ecx
mov word [eax + 2], cx
push esi
lea eax, [ebp - 0x804]
push edi
push eax
call dword [sym.imp.MSVCR120.dll__wcslwr]
mov esi, eax
add esp, 4
mov edx, 0x4e67c6a7
movzx edi, word [esi]
test di, di
je 0x41e82e
lea ecx, [ecx]
mov ecx, edx
lea esi, [esi + 2]
mov eax, edx
shl ecx, 5
shr eax, 2
add ecx, eax
movzx eax, di
movzx edi, word [esi]
add ecx, eax
xor edx, ecx
test di, di
jne 0x41e810
push dword [ebp - 0x1008]
and edx, 0x7fff
lea eax, [ebp - 0x1004]
push edx
push str.20160302_aaaa_aaaa__04x_0000_08x
push eax
call fcn.00423c20
add esp, 0x10
mov dword [ebx + 0x14], 7
xor eax, eax
mov dword [ebx + 0x10], 0
mov word [ebx], ax
pop edi
pop esi
cmp word [ebp - 0x1004], ax
jne 0x41e871
xor ecx, ecx
jmp 0x41e88f
lea ecx, [ebp - 0x1004]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41e880
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x1004]
mov ecx, ebx
push eax
call fcn.00403be0
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00424ad0
mov esp, ebp
pop ebp
ret

Function at 0x4213e0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x20]
push eax
call fcn.0041e8b0
cmp dword [ebp - 0xc], 8
lea eax, [ebp - 0x20]
push 0
cmovae eax, dword [ebp - 0x20]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
jne 0x42141d
xor esi, esi
jmp 0x421448
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x28], 0
push ecx
push eax
mov dword [ebp - 0x24], 0xffffffff
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 0x28]
push eax
push 0x4212a0
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [ebp - 0x28]
cmp dword [ebp - 0xc], 8
jb 0x42145a
push dword [ebp - 0x20]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [ebp - 8]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00424ad0
mov esp, ebp
pop ebp
ret 4
Function at 0x421e20
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428ea8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x44], eax
xor esi, esi
xor edi, edi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], edi
mov eax, dword [eax]
mov esi, dword [eax]
cmp esi, eax
je 0x421fc6
mov ebx, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
push dword [esi + 0x10]
lea eax, [ebp - 0x28]
push eax
call fcn.0041e8b0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
jne 0x421eb1
cmp dword [ebp - 0x14], 8
jb 0x421f4e
push dword [ebp - 0x28]
call ebx
add esp, 4
jmp 0x421f4e
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x40], 0
push ecx
push eax
mov dword [ebp - 0x3c], 0xffffffff
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 0x40]
push eax
push 0x4212a0
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x14], 8
mov ebx, dword [ebp - 0x40]
jb 0x421eee
push dword [ebp - 0x28]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [ebp - 0x38], ebx
test ebx, ebx
je 0x421f48
lea eax, [ebp - 0x38]
cmp eax, edi
jae 0x421f2b
mov ecx, eax
mov eax, dword [ebp - 0x34]
cmp eax, ecx
ja 0x421f2b
mov ebx, ecx
sub ebx, eax
sar ebx, 2
cmp edi, dword [ebp - 0x2c]
jne 0x421f20
push ecx
lea ecx, [ebp - 0x34]
call fcn.00422650
mov edi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
test edi, edi
je 0x421f42
mov eax, dword [eax + ebx*4]
mov dword [edi], eax
jmp 0x421f42
cmp edi, dword [ebp - 0x2c]
jne 0x421f3c
push ecx
lea ecx, [ebp - 0x34]
call fcn.00422650
mov edi, dword [ebp - 0x30]
test edi, edi
je 0x421f42
mov dword [edi], ebx
add edi, 4
mov dword [ebp - 0x30], edi
mov ebx, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
cmp byte [esi + 0xd], 0
jne 0x421f92
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x421f73
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x421f92
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x421f67
jmp 0x421f92
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x421f90
lea esp, [esp]
cmp esi, dword [eax + 8]
jne 0x421f90
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x421f80
mov esi, eax
mov eax, dword [ebp - 0x44]
cmp esi, dword [eax]
jne 0x421e72
mov esi, dword [ebp - 0x34]
cmp esi, edi
je 0x421fbc
mov edx, dword [ebp + 8]
push ecx
push dword [ebp + 0x14]
lea ecx, [ebp - 0x34]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004217b0
add esp, 0x10
test esi, esi
je 0x421fc6
push esi
call ebx
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00424ad0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x421ff0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428e78
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x48], ecx
cmp dword [ebp + 8], 0
jle 0x4221b1
xor eax, eax
xor edi, edi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], edi
mov eax, dword [ecx]
mov esi, dword [eax]
cmp esi, eax
je 0x4221b1
mov ebx, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
lea ebx, [ebx]
push dword [esi + 0x10]
lea eax, [ebp - 0x2c]
push eax
call fcn.0041e8b0
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push 0
cmovae eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
jne 0x42208f
cmp dword [ebp - 0x18], 8
jb 0x42212c
push dword [ebp - 0x2c]
call ebx
add esp, 4
jmp 0x42212c
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x44], 0
push ecx
push eax
mov dword [ebp - 0x40], 0xffffffff
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [ebp - 0x44]
push eax
push 0x4212a0
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x18], 8
mov ebx, dword [ebp - 0x44]
jb 0x4220cc
push dword [ebp - 0x2c]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [ebp - 0x3c], ebx
test ebx, ebx
je 0x422126
lea eax, [ebp - 0x3c]
cmp eax, edi
jae 0x422109
mov ecx, eax
mov eax, dword [ebp - 0x38]
cmp eax, ecx
ja 0x422109
mov ebx, ecx
sub ebx, eax
sar ebx, 2
cmp edi, dword [ebp - 0x30]
jne 0x4220fe
push ecx
lea ecx, [ebp - 0x38]
call fcn.00422650
mov edi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
test edi, edi
je 0x422120
mov eax, dword [eax + ebx*4]
mov dword [edi], eax
jmp 0x422120
cmp edi, dword [ebp - 0x30]
jne 0x42211a
push ecx
lea ecx, [ebp - 0x38]
call fcn.00422650
mov edi, dword [ebp - 0x34]
test edi, edi
je 0x422120
mov dword [edi], ebx
add edi, 4
mov dword [ebp - 0x34], edi
mov ebx, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
cmp byte [esi + 0xd], 0
jne 0x422172
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x422151
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x422172
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x422145
jmp 0x422172
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x422170
lea ebx, [ebx]
cmp esi, dword [eax + 8]
jne 0x422170
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x422160
mov esi, eax
mov eax, dword [ebp - 0x48]
cmp esi, dword [eax]
jne 0x422050
mov eax, dword [ebp - 0x38]
cmp eax, edi
je 0x4221a7
push ecx
mov ecx, dword [ebp + 8]
sub edi, eax
sar edi, 2
xor edx, edx
push ecx
lea eax, [ecx - 1]
add eax, edi
div ecx
lea ecx, [ebp - 0x38]
mov edx, eax
call fcn.00421920
mov eax, dword [ebp - 0x38]
add esp, 8
test eax, eax
je 0x4221b1
push eax
call ebx
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00424ad0
mov esp, ebp
pop ebp
ret 4
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0xd31a20
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x6d4603b7
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401370
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7ec
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x79c], 4
mov dword [ebp - 0x784], 0x80000000
mov dword [ebp - 0x798], 0x20019
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x72c], eax
pushal
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x12d
mov dword [ebp - 0x28], 0x16
mov dword [ebp - 0x7ec], str.222TWARE11asses
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x12c
mov dword [ebp - 0x28], 0x15
mov ecx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [0x4360c8], ecx
mov edx, dword [ebp - 0x7ec]
mov byte [edx], 0x53
mov eax, dword [ebp - 0x7ec]
mov byte [eax + 1], 0x4f
mov ecx, dword [ebp - 0x7ec]
mov byte [ecx + 2], 0x46
mov edx, dword [ebp - 0x7ec]
mov byte [edx + 9], 0x43
mov eax, dword [ebp - 0x7ec]
mov byte [eax + 0xa], 0x6c
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x7ec]
push edx
push 0x80000002
call dword [0x4360c8]
or eax, eax
je 0x401461
xor eax, eax
jmp 0x401706
lea eax, [ebp - 0x34]
push eax
push str.clsid09474572_b2fb_11d1_a1a1_0000f875b132inprocserver32
push 0x80000000
call dword [0x4360c8]
or eax, eax
je 0x401480
xor eax, eax
jmp 0x401706
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
or eax, eax
jne 0x401498
xor eax, eax
jmp 0x401706
push 1
mov ecx, dword [0x4360c4]
push ecx
jmp 0x45b8b4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401a70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x114], str._ffffffffffffffff
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x11c], eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 0x11c]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x401aea
cmp dword [ebp - 0x118], 0
je 0x401aea
jmp 0x401b4c
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x401b4c
mov dword [ebp - 0x120], 0x3c41
mov eax, dword [ebp + 8]
add eax, 8
mov dword [0x4360b4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [0x4360d0], edx
mov dword [ebp - 0x120], 0x3c41
mov dword [ebp - 0x120], 0x3c41
call fcn.004011c0
mov eax, dword [ebp + 8]
mov dword [0x4360cc], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
call fcn.00401980
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x401aea
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x7066ec
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x7f0f072c
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219