joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10050e4e
Capabilities:
Get hostname

Disassembly:
push ebp
lea ebp, [esp - 0xc0]
sub esp, 0x140
mov eax, dword [0x100de3a4]
xor eax, ebp
mov dword [ebp + 0xbc], eax
push esi
mov esi, dword [ebp + 0xc8]
mov eax, 0x80
push eax
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x44]
push 0
push eax
mov byte [esi], 0
call fcn.1007b650
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x44]
push eax
push 3
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x10050eee
push 1
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x80]
call fcn.10050b86
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.10052424
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x80]
call fcn.1005070f
cmp dword [ebp - 0x48], 0x10
mov eax, dword [ebp - 0x5c]
jae 0x10050ed0
lea eax, [ebp - 0x5c]
movzx ecx, word [ebp + 0xcc]
push ecx
push eax
push esi
call fcn.1004b101
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x60]
call fcn.10001b20
mov ecx, dword [ebp + 0xbc]
xor ecx, ebp
pop esi
call fcn.1007b636
add ebp, 0xc0
leave
ret

Function at 0x10055600
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
ret

Function at 0x10055720
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x1004
call fcn.1007d780
mov eax, dword [0x100de3a4]
xor eax, esp
mov dword [esp + 0x1000], eax
mov ecx, dword [esp + 0x1010]
mov eax, dword [esp + 0x100c]
push esi
mov esi, dword [esp + 0x100c]
push ecx
push eax
test esi, esi
jne 0x100557a8
lea eax, [esp + 0xc]
push 0xffd
push eax
call fcn.10082308
add esp, 0x10
test eax, eax
jle 0x10055770
lea eax, [esp + eax + 4]
jmp 0x1005577c
cmp eax, 0xffffffff
jne 0x100557b7
lea eax, [esp + 0x1001]
mov byte [eax], 0xd
inc eax
lea ecx, [esp + 4]
mov byte [eax], 0xa
push ecx
mov byte [eax + 1], 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.1007b636
add esp, 0x1004
ret
push esi
call fcn.10082217
push esi
call fcn.10082021
add esp, 0x10
mov ecx, dword [esp + 0x1004]
pop esi
xor ecx, esp
call fcn.1007b636
add esp, 0x1004
ret
Function at 0x10056700
Capabilities:
Get common file path

Disassembly:
sub esp, 0x804
mov eax, dword [0x100de3a4]
xor eax, esp
mov dword [esp + 0x800], eax
push edi
mov edi, dword [esp + 0x80c]
lea eax, [esp + 4]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1005679b
lea ecx, [esp + 4]
push esi
push ecx
call fcn.100551c0
add esp, 4
mov esi, eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10056743
sub eax, edx
je 0x10056759
cmp byte [eax + esi - 1], 0x5c
jne 0x10056759
mov byte [eax + esi - 1], cl
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10056760
sub eax, edx
mov edx, dword [esp + 0x814]
push eax
push esi
push edx
push edi
call fcn.10055220
push esi
call fcn.1007af72
add esp, 0x14
pop esi
mov eax, edi
pop edi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.1007b636
add esp, 0x804
ret
mov ecx, dword [esp + 0x804]
pop edi
xor ecx, esp
xor eax, eax
call fcn.1007b636
add esp, 0x804
ret

Function at 0x100568e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x804
mov eax, dword [0x100de3a4]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [esp + 0x80c]
push esi
dec eax
push edi
mov edi, dword [esp + 0x810]
cmp eax, 0xfe
ja case.0x10056913.2
movzx eax, byte [eax + 0x100569e4]
jmp dword [eax*4 + 0x100569d4]
mov esi, 0x2b
jmp 0x1005692d
mov esi, 0x23
jmp 0x1005692d
mov esi, 0x2c
lea ecx, [esp + 8]
push ecx
push 0
push 0
mov edx, esi
or edx, 0x8000
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x10056972
cmp esi, 0x2c
jne 0x100569ba
push 1
push edi
call fcn.100568e0
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.1007b636
add esp, 0x804
ret
lea eax, [esp + 8]
push eax
call fcn.100551c0
mov esi, eax
add esp, 4
test esi, esi
je 0x100569ba
push 0x400
push esi
push 0x400
push edi
call fcn.10055220
push esi
mov edi, eax
call fcn.1007af72
add esp, 0x14
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.1007b636
add esp, 0x804
ret
mov ecx, dword [esp + 0x808]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.1007b636
add esp, 0x804
ret

Function at 0x1005a1d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100ba98e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100de3a4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.10057a60
mov dword [esi + 4], eax
mov byte [eax + 0x75], 1
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [eax + 8], eax
xor eax, eax
mov dword [esi + 8], eax
mov dword [esp + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x30], eax
mov byte [esi + 0x20], al
mov ecx, esi
mov byte [esp + 0x14], 2
mov byte [esi + 0x38], al
mov byte [esi + 0x39], al
call fcn.10068ed0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x100628d0
Capabilities:
Create thread
Resume thread

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x10062921
push 0xc
call fcn.1007aeb6
add esp, 4
test eax, eax
je 0x1006290d
mov ecx, dword [esp + 0xc]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 4], edi
mov dword [eax + 8], ecx
mov ecx, eax
pop edi
jmp 0x10069ca0
mov ecx, dword [esp + 0xc]
xor eax, eax
mov dword [eax + 4], edi
mov dword [eax + 8], ecx
mov ecx, eax
pop edi
jmp 0x10069ca0
pop edi
ret
push esi
push 0xc
mov esi, ecx
call fcn.1007aeb6
add esp, 4
push 0
push 4
push eax
mov dword [eax], esi
mov ecx, dword [esi + 4]
push 0x10062960
mov dword [eax + 4], ecx
mov edx, dword [esi + 8]
push 0
push 0
mov dword [eax + 8], edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
jmp dword [sym.imp.KERNEL32.dll_SwitchToThread]

Function at 0x10064780
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x100babe3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x100de3a4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0x100e2f28
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esp + 0x18], ebx
mov dword [ecx], 0x100e2f28
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x100be419
mov byte [esp + 0x20], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.10062b80
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x10065150
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100bad49
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100de3a4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
or eax, 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 4], eax
xor ebx, ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0x100e2f28
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 5
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea edi, [esi + 0x2c]
mov dword [esi], vtable.TiXmlDeclaration.0
mov dword [esp + 0x20], ebx
mov dword [edi], 0x100e2f28
lea ebp, [esi + 0x30]
mov dword [ebp], 0x100e2f28
mov dword [esi + 0x34], 0x100e2f28
mov ecx, dword [esp + 0x28]
mov eax, ecx
lea edx, [eax + 1]
mov byte [esp + 0x20], 3
mov dword [esp + 0x28], edx
lea esp, [esp]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x100651e0
sub eax, dword [esp + 0x28]
push eax
push ecx
mov ecx, edi
call fcn.10062b80
mov edi, dword [esp + 0x2c]
mov eax, edi
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10065200
sub eax, ecx
push eax
push edi
mov ecx, ebp
call fcn.10062b80
mov edx, dword [esp + 0x30]
mov eax, edx
lea edi, [eax + 1]
jmp 0x10065220
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10065220
sub eax, edi
push eax
push edx
lea ecx, [esi + 0x34]
call fcn.10062b80
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc

Function at 0x1006ab80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100bb538
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x100de3a4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.1006f950
xor ebx, ebx
push 0x1006ab00
push 0x1006aaf0
push 0x3fd
push 0xc
lea eax, [esi + 0x38]
push eax
mov dword [esp + 0x2c], ebx
mov dword [esi], vtable.devtech_private::FastArray.0
mov byte [esi + 8], 1
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
call fcn.1008522a
mov dword [esi + 0x3014], ebx
mov dword [esi + 0x3018], ebx
mov dword [esi + 0x301c], ebx
mov dword [esi + 0x3020], ebx
mov dword [esi + 0x3024], ebx
mov byte [esi + 0x3028], 1
mov dword [esi + 0x302c], ebx
mov byte [esi + 0x3030], bl
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x1007b636
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100de3a4]
jne 0x1007b640
repz ret
jmp fcn.1008c21c

Function at 0x10083c2d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x10083c5e
call fcn.10083e7c
mov dword [eax], esi
call fcn.10083e69
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.1007b176
add esp, 0x14
push 0x16
pop eax
jmp 0x10083cb3
test dword [ebp + 0xc], 0xfffffff9
jne 0x10083c3a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10083c8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10083e8f
pop ecx
call fcn.10083e69
mov eax, dword [eax]
jmp 0x10083cb3
test al, 0x10
jne 0x10083cb1
test al, 1
je 0x10083cb1
test byte [ebp + 0xc], 2
je 0x10083cb1
call fcn.10083e7c
mov dword [eax], 5
call fcn.10083e69
mov dword [eax], 0xd
jmp 0x10083c82
xor eax, eax
pop esi
pop ebp
ret

Function at 0x100983f2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x10098423
call fcn.10083e7c
mov dword [eax], esi
call fcn.10083e69
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.1007b176
add esp, 0x14
push 0x16
pop eax
jmp 0x10098478
test dword [ebp + 0xc], 0xfffffff9
jne 0x100983ff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10098450
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10083e8f
pop ecx
call fcn.10083e69
mov eax, dword [eax]
jmp 0x10098478
test al, 0x10
jne 0x10098476
test al, 1
je 0x10098476
test byte [ebp + 0xc], 2
je 0x10098476
call fcn.10083e7c
mov dword [eax], 5
call fcn.10083e69
mov dword [eax], 0xd
jmp 0x10098447
xor eax, eax
pop esi
pop ebp
ret
Function at 0x100a23c6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1008bb50
and dword [ebp - 4], 0
cmp dword [0x100e3d0c], 0
mov ebx, eax
jne 0x100a2477
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100a2528
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100a2528
push eax
call fcn.1008bade
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100e3d0c], eax
call esi
push eax
call fcn.1008bade
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100e3d10], eax
call esi
push eax
call fcn.1008bade
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100e3d14], eax
call esi
push eax
call fcn.1008bade
pop ecx
mov dword [0x100e3d1c], eax
test eax, eax
je 0x100a2477
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1008bade
pop ecx
mov dword [0x100e3d18], eax
mov eax, dword [0x100e3d18]
cmp eax, ebx
je 0x100a24cf
cmp dword [0x100e3d1c], ebx
je 0x100a24cf
push eax
call fcn.1008bb59
push dword [0x100e3d1c]
mov esi, eax
call fcn.1008bb59
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100a24cf
test edi, edi
je 0x100a24cf
call esi
test eax, eax
je 0x100a24c6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100a24c6
test byte [ebp - 0xc], 1
jne 0x100a24cf
or dword [ebp + 0x10], 0x200000
jmp 0x100a2508
mov eax, dword [0x100e3d10]
cmp eax, ebx
je 0x100a2508
push eax
call fcn.1008bb59
pop ecx
test eax, eax
je 0x100a2508
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100a2508
mov eax, dword [0x100e3d14]
cmp eax, ebx
je 0x100a2508
push eax
call fcn.1008bb59
pop ecx
test eax, eax
je 0x100a2508
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100e3d0c]
call fcn.1008bb59
pop ecx
test eax, eax
je 0x100a2528
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100a252a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4018da
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x41f100]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x419e20
call fcn.00402c29
push dword [ebp + 0x214]
xor edi, edi
mov dword [ebp - 4], edi
call fcn.00401896
pop ecx
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push edi
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
lea eax, [ebp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, 0x41fd88
push esi
push edi
push str.kutryrhdsdr235g3454
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], edi
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v4
call fcn.004017bf
call fcn.00401841
pop ecx
push eax
call fcn.00401251
pop ecx
push 0x41b20c
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x41b1f0
test al, al
je 0x401a83
mov byte [ebp - 4], 1
call fcn.004017bf
call fcn.00401841
pop ecx
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.RemoteProcess.Program
call fcn.004017bf
call fcn.00401841
pop ecx
push eax
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.v4.0.30319
call fcn.004017bf
call fcn.00401841
pop ecx
push eax
call fcn.004013c5
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00402be7
add ebp, 0x20c
leave
ret
mov byte [ebp - 4], 3
call fcn.004017bf
call fcn.00401841
pop ecx
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.RemoteProcess.Program
call fcn.004017bf
call fcn.00401841
pop ecx
push eax
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x41b194
call fcn.004017bf
call fcn.00401841
pop ecx
push eax
call fcn.004013c5
add esp, 0x14
jmp 0x401a03

Function at 0x402be7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41f100]
jne 0x402bf1
repz ret
jmp fcn.00405d8c
Function at 0x410318
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004056be
and dword [ebp - 4], 0
cmp dword [0x420b08], 0
mov ebx, eax
jne 0x4103c9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41047a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41047a
push eax
call fcn.0040564c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x420b08], eax
call esi
push eax
call fcn.0040564c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x420b0c], eax
call esi
push eax
call fcn.0040564c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x420b10], eax
call esi
push eax
call fcn.0040564c
pop ecx
mov dword [0x420b18], eax
test eax, eax
je 0x4103c9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040564c
pop ecx
mov dword [0x420b14], eax
mov eax, dword [0x420b14]
cmp eax, ebx
je 0x410421
cmp dword [0x420b18], ebx
je 0x410421
push eax
call fcn.004056c7
push dword [0x420b18]
mov esi, eax
call fcn.004056c7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x410421
test edi, edi
je 0x410421
call esi
test eax, eax
je 0x410418
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x410418
test byte [ebp - 0xc], 1
jne 0x410421
or dword [ebp + 0x10], 0x200000
jmp 0x41045a
mov eax, dword [0x420b0c]
cmp eax, ebx
je 0x41045a
push eax
call fcn.004056c7
pop ecx
test eax, eax
je 0x41045a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41045a
mov eax, dword [0x420b10]
cmp eax, ebx
je 0x41045a
push eax
call fcn.004056c7
pop ecx
test eax, eax
je 0x41045a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x420b08]
call fcn.004056c7
pop ecx
test eax, eax
je 0x41047a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41047c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ecx
cmp byte [0x411007], 0
mov dword [esp], 0
je 0x40102d
push str.password:
call fcn.00401617
lea eax, [esp + 4]
push eax
push 0x40e1b0
call fcn.004015fa
add esp, 0xc
push esi
push 0x40e1ac
push str.RunTmpXXX.exe
call fcn.00401566
mov esi, eax
add esp, 8
test esi, esi
je 0x4010c2
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x401070
mov eax, 0xc
jmp 0x401060
xor dword [eax + section..data], ecx
add eax, 4
cmp eax, 0xebde75
jl 0x401060
push esi
push 0xebde69
push 1
push 0x41100c
call fcn.00401430
push esi
call fcn.00401265
push str.RunTmpXXX2.exe
call fcn.004011c8
push str.RunTmpXXX.exe
call fcn.004010d9
push str.RunTmpXXX2.exe
call fcn.004010d9
push str.RunTmpXXX.exe
call fcn.004011c8
push str.RunTmpXXX2.exe
call fcn.004011c8
add esp, 0x28
xor eax, eax
pop esi
pop ecx
ret
push str.Cant_create_run_file_nPress_Enter_n
call fcn.00401617
add esp, 4
call fcn.004011c3
xor eax, eax
pop esi
pop ecx
ret

Function at 0x401f8e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x401fb5
call fcn.00401f58
mov dword [eax], esi
call fcn.00401f45
push 0x16
pop esi
mov dword [eax], esi
call fcn.004019f2
mov eax, esi
jmp 0x40200a
test dword [ebp + 0xc], 0xfffffff9
jne 0x401f9b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x401fe2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401f6b
pop ecx
call fcn.00401f45
mov eax, dword [eax]
jmp 0x40200a
test al, 0x10
jne 0x402008
test al, 1
je 0x402008
test byte [ebp + 0xc], 2
je 0x402008
call fcn.00401f58
mov dword [eax], 5
call fcn.00401f45
mov dword [eax], 0xd
jmp 0x401fd9
xor eax, eax
pop esi
pop ebp
ret

Function at 0x406be2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x12cf280]
jne 0x406bec
repz ret
jmp fcn.0040aa89
Function at 0x40a6b3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x12cf280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004066ad
and dword [ebp - 0x14], 0
cmp dword [0x12d0694], 0
mov dword [ebp - 0x18], eax
jne 0x40a766
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40a80e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40a80e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x12d0694], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x12d0698], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x12d069c], eax
call edi
push eax
call esi
mov dword [0x12d06a4], eax
test eax, eax
je 0x40a766
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x12d06a0], eax
mov eax, dword [0x12d06a0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40a7bf
cmp dword [0x12d06a4], ecx
je 0x40a7bf
push eax
call esi
push dword [0x12d06a4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40a7bf
test ebx, ebx
je 0x40a7bf
call edi
test eax, eax
je 0x40a7b6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40a7b6
test byte [ebp - 8], 1
jne 0x40a7bf
or dword [ebp + 0x10], 0x200000
jmp 0x40a7f2
mov eax, dword [0x12d0698]
cmp eax, dword [ebp - 0x18]
je 0x40a7f2
push eax
call esi
test eax, eax
je 0x40a7f2
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40a7f2
mov eax, dword [0x12d069c]
cmp eax, dword [ebp - 0x18]
je 0x40a7f2
push eax
call esi
test eax, eax
je 0x40a7f2
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x12d0694]
call esi
test eax, eax
je 0x40a80e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40a810
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406be2
leave
ret