joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a30dd20
Capabilities:
Terminate thread

Disassembly:
push 0xc
mov eax, 0x2a353dc6
call fcn.2a302657
mov ebx, ecx
xor ecx, ecx
cmp dword [ebx], 0xb
mov edi, ecx
mov dword [ebp - 0x14], edi
jne 0x2a30de11
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
or dword [ebx + 0x1a0], 0xffffffff
push 1
push dword [ebx + 0x2d4]
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
lea esi, [eax + 0x12c]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
cmp eax, esi
jae 0x2a30ddca
mov edi, esi
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [ebx + 0x2d8]
mov esi, dword [ebx]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
cmp esi, 0xb
jne 0x2a30ddc7
push 0x64
call dword [sym.imp.kernel32.dll_Sleep]
call dword [sym.imp.kernel32.dll_GetTickCount]
shr eax, 4
cmp eax, edi
jb 0x2a30dd8e
mov edi, dword [ebp - 0x14]
push 0xea60
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp dword [ebx], 0xb
jne 0x2a30ddf1
push 1
push dword [ebx + 0x2d4]
call dword [sym.imp.kernel32.dll_TerminateThread]
xor edi, edi
inc edi
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
push dword [ebx + 0x2d8]
call dword [sym.imp.kernel32.dll_CloseHandle]
xor ecx, ecx
mov dword [ebx + 0x2d8], ecx
cmp dword [ebx + 0x18], 0
lea esi, [ebx + 0x1a0]
mov dword [esi], ecx
je 0x2a30de46
test di, di
jne 0x2a30de43
push esi
push dword [ebx + 0x18]
call fcn.2a32cd08
xor ecx, ecx
cmp dword [esi], ecx
jne 0x2a30de46
push esi
push dword [ebx + 0x14]
mov dword [ebx + 0x18], ecx
call fcn.2a32cd08
xor ecx, ecx
jmp 0x2a30de46
mov dword [ebx + 0x18], ecx
cmp word [ebx + 0x144], cx
je 0x2a30decd
push ecx
push ecx
lea ecx, [ebp - 0x18]
call fcn.2a32cd08
mov edi, dword [0x2a36bb18]
xor eax, eax
push eax
mov dword [ebp - 4], eax
lea eax, [ebx + 0x40]
push eax
mov eax, dword [0x2a36bb0c]
push str.Cstring
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x2a35835c]
call esi
mov esi, dword [edi + 0xd0]
pop ecx
movzx eax, ax
mov ecx, esi
push eax
push 0
call dword [0x2a35835c]
call esi
add esp, 0x10
lea ecx, [ebp - 0x18]
push 0
push eax
call fcn.2a32cd08
cmp dword [ebp - 0x14], 0
je 0x2a30debf
lea ecx, [ebp - 0x18]
call fcn.2a32cd08
test al, al
je 0x2a30debf
lea ecx, [ebp - 0x18]
call fcn.2a33ed32
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.2a32cd08
xor ecx, ecx
cmp dword [ebx + 0x34], 0
je 0x2a30def1
mov eax, dword [0x2a36b7ac]
push dword [ebx + 0x34]
mov esi, dword [eax + 0x284]
mov ecx, esi
call dword [0x2a35835c]
call esi
pop ecx
xor ecx, ecx
mov dword [ebx + 0x34], ecx
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x2a30df25
push eax
mov eax, dword [0x2a36bb38]
cmp word [ebx + 0x196], cx
je 0x2a30df0f
mov esi, dword [eax + 0x124]
jmp 0x2a30df15
mov esi, dword [eax + 0x11c]
mov ecx, esi
call dword [0x2a35835c]
call esi
xor eax, eax
pop ecx
mov dword [ebx + 0x20], eax
mov dword [ebx], 2
call fcn.2a302bc2
ret
Function at 0x2a32caab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x2a35572a
call fcn.2a304215
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x2a32cccc
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.2a32cd08
add esp, 0x10
test eax, eax
js 0x2a32ccc6
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x2a32cb4f
push edi
call fcn.2a32df9a
pop ecx
test al, al
je 0x2a32cb4f
mov eax, edi
call fcn.2a352aa0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x2a32cb61
push edi
lea ecx, [ebp - 0x424]
call fcn.2a32cd08
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.2a32cd08
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x2a32ccc6
push 0x60
push ebx
push eax
call fcn.2a32e256
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x2a32cbb9
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.2a32e256
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x2a32cbb9
call fcn.2a32b317
mov ebx, eax
jmp 0x2a32cc95
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x2a32cbe0
call fcn.2a32b317
jmp 0x2a32cc88
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x2a32cbd6
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x2a32cc13
mov ebx, 0x8007000e
jmp 0x2a32cc8a
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2a32cd08
jmp 0x2a32cc39
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x2a32cc0c
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.2a32cd08
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.2a32cd08
mov ebx, eax
test edi, edi
je 0x2a32cc95
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2a32ccae
lea ecx, [ebp - 0x418]
call fcn.2a32b98d
or dword [ebp - 4], 0xffffffff
jmp 0x2a32ccbe
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32ccb4
mov eax, ebx
jmp 0x2a32ccfa
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x2a32cce1
lea ecx, [ebp - 0x418]
call fcn.2a32b98d
or dword [ebp - 4], 0xffffffff
jmp 0x2a32ccf1
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32cce7
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.2a30424f
ret 0x10
Function at 0x404370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push dword [edi + 0x10]
call fcn.00404270
push dword [edi + 0x14]
call fcn.00406465
lea esi, [edi + 0x20]
xor ecx, ecx
mov edi, dword [edi + 0x14]
add esp, 8
mov edx, eax
mov dword [ebp - 4], ecx
xor ebx, ebx
mov dword [ebp - 0xc], edx
test edi, edi
je 0x4043d9
sub eax, esi
mov dword [ebp - 8], eax
nop word [eax + eax]
call fcn.00404220
mov cl, byte [esi]
lea esi, [esi + 1]
sub cl, al
mov eax, dword [ebp - 8]
mov byte [eax + esi - 1], cl
movzx eax, byte [esi - 1]
mov ecx, dword [ebp - 4]
xor ebx, eax
add ecx, eax
mov dword [ebp - 4], ecx
sub edi, 1
jne 0x4043b0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
cmp word [eax + 0x1c], cx
jne 0x4043f1
cmp word [eax + 0x1e], bx
jne 0x4043f1
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
push edx
call fcn.0040646e
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4048f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x457024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [ebp - 6]
push eax
call fcn.00404270
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
add esp, 4
mov dword [ebp - 0x18], ecx
xor ebx, ebx
mov edi, dword [edx + 0x14]
lea esi, [edx + 0x20]
test edi, edi
je 0x40495a
call fcn.00404220
mov ecx, dword [ebp - 0x18]
lea esi, [esi + 1]
movzx eax, ax
add byte [esi - 1], al
mov al, byte [esi - 1]
movzx eax, al
xor ecx, eax
add ebx, eax
mov dword [ebp - 0x18], ecx
sub edi, 1
jne 0x404934
mov edx, dword [ebp - 0x1c]
movzx eax, word [ebp - 6]
mov word [edx + 0x1e], cx
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov word [edx + 0x1c], bx
xor ecx, ebp
mov dword [edx + 0x10], eax
pop ebx
call fcn.004063c7
mov esp, ebp
pop ebp
ret

Function at 0x4339eb
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004338bf

Function at 0x436153
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00435b11
Function at 0x1001ed52
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001ebc8
Function at 0x100176c0
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov eax, dword [0x1001e7f8]
mov eax, dword [eax]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x22c]
call eax
test eax, eax
je 0x10017710
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005d70
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005d10
ret

Function at 0x10017720
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001e7f8]
mov eax, dword [eax]
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10017763
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005d70
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005d10
ret

Function at 0x10017ff3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001e108]
jne 0x10017ffd
repz ret
jmp fcn.10018482

Function at 0x1001813f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1001814e
pop dword [ebp - 0x2c]
mov eax, 0xc5b4c1f8
sub eax, 0xb5b340aa
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x285de16b
add dword [ebp - 0x3c], 0x25f463e0
mov dword [ebp - 0x38], 0x9c3d779a
add dword [ebp - 0x38], 0x95f5d4ab
mov dword [ebp - 0x34], 0xf7f23d03
add dword [ebp - 0x34], 0x545a072b
mov dword [ebp - 0x30], 0x59d9faf3
add dword [ebp - 0x30], 0xa626050d
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xa7d9265b
add dword [ebp - 0x3c], 0xcc9942fb
mov dword [ebp - 0x38], 0xbabe6ed6
sub dword [ebp - 0x38], 0x79520d61
mov dword [ebp - 0x34], 0xee4514f6
add dword [ebp - 0x34], 0x752a5776
mov dword [ebp - 0x30], 0x6139a02d
add dword [ebp - 0x30], 0x9ec65fd3
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x3ba6dc3f
sub eax, 0x2ba54beb
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3af0f
push 0
call eax
mov ecx, 0xee31a20d
add ecx, 0x11ceb7b3
xor ebx, ebx
add ebx, eax
mov esi, 0x10021a00
add esi, dword [ebp - 0x2c]
mov edi, 0x5e8ad732
add edi, 0x489672a4
add dword [ebp - 0x20], edi
mov edx, dword [esi]
add dword [ebp - 0x24], edi
sub edx, edi
xor dword [ebp - 0x24], ebx
mov dword [ebx], edx
xor dword [ebp - 0x10], edi
add ebx, 4
add esi, 0x9c482fc2
sub esi, 0x9c482fbe
loop 0x10018267
add eax, 0x159d3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x8eb67c10
sub ecx, 0x7eb67c10
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x102767e
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
mov eax, edx
not eax
je 0x1027694
push esi
movsx esi, byte [ecx]
rol eax, 3
xor eax, esi
inc ecx
dec edx
jne 0x1027687
pop esi
ret

Function at 0x1027b00
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
mov edi, 0x100aeb8
push dword [ebp + 8]
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
je 0x1027b40
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push 0x100af04
jmp 0x1027b72
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x14]
lea eax, [ebp + 8]
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
je 0x1027b7c
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push 0x100aec0
call fcn.01015c5a
add esp, 0x10
jmp 0x1027b98
cmp dword [ebp + 8], 4
je 0x1027b98
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push 0x100af48
call fcn.01015c5a
add esp, 0xc
push 0xd
pop esi
lea ecx, [ebp - 8]
mov dword [ebp - 8], edi
call fcn.01027ae5
pop edi
mov eax, esi
pop esi
leave
ret 0x18

Function at 0x1027bb0
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x1c], edi
mov ebx, 0x100aeb8
mov dword [ebp - 8], ebx
mov dword [ebp - 4], edi
lea eax, [ebp - 4]
je 0x1027bf9
push edi
push eax
push edi
push 2
push dword [ebp + 0x10]
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
cmp esi, edi
je 0x1027c1d
push esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push 0x100afd0
jmp 0x1027c44
push eax
push 2
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, edi
je 0x1027c1d
push esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push 0x100af04
jmp 0x1027c44
push 4
lea eax, [ebp + 0x18]
push eax
push 4
push edi
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
cmp esi, edi
je 0x1027c4c
push esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push 0x100af8c
call fcn.01015c5a
add esp, 0x10
lea ecx, [ebp - 8]
mov dword [ebp - 8], ebx
call fcn.01027ae5
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x20

Function at 0x1028451
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x102845f
sub eax, ecx
mov ecx, eax
not eax
je 0x102847a
movsx edx, byte [esi]
rol eax, 3
xor eax, edx
inc esi
dec ecx
jne 0x102846e
pop esi
pop ebp
ret 4
Function at 0x1000b197
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, ecx
test si, si
jne 0x1000b24c
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1000b24c
mov edx, dword [esi + 0x3c]
test dl, 3
jne 0x1000b24c
cmp dword [edx + esi], 0x4550
jne 0x1000b24c
cmp dword [edx + esi + 0x74], 6
jb 0x1000b24c
push ebx
mov ebx, dword [edx + esi + 0x50]
push edi
mov edi, dword [edx + esi + 0xa8]
lea eax, [ebx - 1]
lea ecx, [edi - 1]
cmp ecx, eax
jae 0x1000b24a
mov eax, dword [edx + esi + 0xac]
mov ecx, ebx
sub ecx, edi
cmp eax, ecx
ja 0x1000b24a
xor edx, edx
add edi, esi
push 0x1c
pop ecx
div ecx
mov edx, eax
test edx, edx
je 0x1000b24a
imul ecx, edx, 0x1c
add ecx, 0x14
add ecx, edi
lea ecx, [ecx - 0x1c]
dec edx
cmp dword [ecx - 8], 2
lea edi, [ecx - 0x14]
jne 0x1000b228
cmp dword [ecx], ebx
jae 0x1000b228
mov eax, ebx
sub eax, dword [ecx]
cmp dword [ecx - 4], eax
jbe 0x1000b22e
test edx, edx
jne 0x1000b20e
jmp 0x1000b24a
push 0x1c
push edi
call dword [sym.imp.kernel32.dll_VirtualLock]
test eax, eax
je 0x1000b24a
mov eax, dword [edi + 0x14]
push dword [edi + 0x10]
add eax, esi
push eax
call dword [sym.imp.kernel32.dll_VirtualLock]
pop edi
pop ebx
pop esi
ret

Function at 0x1000c446
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1000c455
pop dword [ebp - 8]
mov eax, 0x2eecc094
sub eax, 0x1eebfc3f
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x3b6bd
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0xb8a661f1
add ecx, 0x4759efd7
xor edi, edi
add edi, eax
mov ebx, 0x10018600
add ebx, dword [ebp - 8]
mov esi, 0x68803e7
add dword [ebp - 4], eax
mov edx, dword [ebx]
xor edx, esi
sub dword [ebp - 4], 0x9a6ff7a2
mov dword [edi], edx
xor dword [ebp - 4], eax
add edi, 4
add ebx, 4
loop 0x1000c4a5
add eax, 0x139f3
xor ebx, ebx
add ebx, eax
add eax, 0x2ada2b16
sub eax, 0x2ada2b11
mov ecx, 0xc9c81e8b
add ecx, 0x4637e175
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x401069
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44c030]
jne 0x401073
repz ret
jmp fcn.00401d81

Function at 0x40856b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040277c
and dword [ebp - 4], 0
cmp dword [0x44e8b4], 0
mov ebx, eax
jne 0x40861c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4086cd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4086cd
push eax
call fcn.0040270a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44e8b4], eax
call esi
push eax
call fcn.0040270a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44e8b8], eax
call esi
push eax
call fcn.0040270a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44e8bc], eax
call esi
push eax
call fcn.0040270a
pop ecx
mov dword [0x44e8c4], eax
test eax, eax
je 0x40861c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040270a
pop ecx
mov dword [0x44e8c0], eax
mov eax, dword [0x44e8c0]
cmp eax, ebx
je 0x408674
cmp dword [0x44e8c4], ebx
je 0x408674
push eax
call fcn.00402785
push dword [0x44e8c4]
mov esi, eax
call fcn.00402785
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408674
test edi, edi
je 0x408674
call esi
test eax, eax
je 0x40866b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40866b
test byte [ebp - 0xc], 1
jne 0x408674
or dword [ebp + 0x10], 0x200000
jmp 0x4086ad
mov eax, dword [0x44e8b8]
cmp eax, ebx
je 0x4086ad
push eax
call fcn.00402785
pop ecx
test eax, eax
je 0x4086ad
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4086ad
mov eax, dword [0x44e8bc]
cmp eax, ebx
je 0x4086ad
push eax
call fcn.00402785
pop ecx
test eax, eax
je 0x4086ad
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44e8b4]
call fcn.00402785
pop ecx
test eax, eax
je 0x4086cd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4086cf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40ae80
Capabilities:
Set console window title

Disassembly:
mov eax, dword [0x2c2c264]
sub esp, 0x1c
push ebx
mov ebx, dword [0x2c2bf88]
push esi
mov esi, dword [0x44cf70]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40aeb0
push str.tehibosuneyowo
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2c2c264]
mov dword [0x44ea14], esi
cmp eax, 0x114e
jne 0x40aeda
lea eax, [esp + 0xc]
push eax
push str.wuzatewuleyicuf
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov eax, dword [0x2c2c264]
cmp eax, 0x2f
jne 0x40aef7
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push ebx
call fcn.0040ad70
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4014b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x4014b4
lcall 0x5de5, 0x8b10c483
jmp loc.00d7eec4
Function at 0x417f2e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x417f3d
pop dword [ebp - 4]
mov eax, 0xab111eae
add eax, 0x5530608f
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x38830
push 0
mov eax, 0x3bb24b05
sub eax, 0x3b6fbad9
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0x79e69b0b
sub ecx, 0x79e65531
mov edx, eax
mov esi, 0x436e00
add esi, dword [ebp - 4]
mov ebx, 0x7827ec9c
mov edi, dword [esi]
xor edi, ebx
mov dword [edx], edi
add edx, 0xe8d5443c
add edx, 0x172abbc8
add esi, 4
loop 0x417f90
add eax, 0x291bf256
sub eax, 0x291ae81b
xor ebx, ebx
add ebx, eax
add eax, 0x71e2e134
add eax, 0x8e1d1ed1
mov ecx, 0xfbfc8237
sub ecx, 0xfbbc8237
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x41e7e0
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x2d4
push esi
call dword [sym.imp.kernel32.dll_GetVersion]
cmp ax, 6
je 0x41e81d
push str.SetDefaultDllDirectories
push 0x429a14
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x41e81d
push 0xc00
call eax
test eax, eax
jne 0x41e8b6
lea eax, [esp + 8]
push 0x106
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
je 0x41e8b6
cmp eax, 0x104
ja 0x41e8b6
cmp word [esp + eax*2 + 6], 0x5c
je 0x41e84c
mov word [esp + eax*2 + 8], 0x5c
inc eax
mov esi, dword [str.userenv]
cmp byte [esi], 0
je 0x41e8b6
push ebp
lea ecx, [esp + eax*2 + 0xc]
push edi
mov edi, dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov dword [esp + 0xc], ecx
mov ebp, 0x6c
mov cl, byte [esi]
mov eax, dword [esp + 0xc]
inc esi
test cl, cl
je 0x41e88b
xor dx, dx
add eax, 2
mov dl, cl
inc esi
mov word [eax - 2], dx
mov cl, byte [esi - 1]
test cl, cl
jne 0x41e877
mov word [eax], 0x2e
mov word [eax + 2], 0x64
mov word [eax + 4], bp
mov word [eax + 6], bp
mov word [eax + 8], 0
push 8
lea eax, [esp + 0x14]
push 0
push eax
call edi
cmp byte [esi], 0
jne 0x41e86c
pop edi
pop ebp
pop esi
add esp, 0x2d4
ret
Function at 0x84e600
Capabilities:
Encode data using xor

Disassembly:
add al, byte [edx + 0xfbaf706]
les ecx, [edi - 9]
or dl, byte [ecx - 0x47797008]
sbb eax, ebx
out 0xe5, eax
cli
inc edx
push esp
adc al, 0x1d
adc eax, 0x42b7a1a0
test dword [0x10c9baa7], edx
mul cl
push esp
cwde
or dword [edi], edi
push 0x52944c0b
xchg esp, eax
push edx
shr byte [ecx], 1
dec eax
pop ebp
xor dword [eax - 0x1872778b], 0x4eb3749d
mov edx, 0x3ae092bb
pmulhuw mm5, mm0
das
dec eax
js 0x84e62c
sahf
inc esi
push 0x142926b
mov eax, dword [0x4da17afd]
fbld tbyte [ebx + 0x57]
cmp dword [esi - 0x12fc9ac2], edi
out 0x25, eax
test byte [edx - 0x7a], cl
fistp word [ebp - 0x6b]
ror ch, 1
pop ebx
dec edi
push edi
invalid