joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477cd0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x47000]
mov dword [edi + 0x63d00], 0xc48b0577
push edi
jmp 0x477cfa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x477d01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x477cf0
mov eax, 1
add ebx, ebx
jne 0x477d13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x477d24
jne 0x477d43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x477d43
dec eax
add ebx, ebx
jne 0x477d30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x477d08
add ebx, ebx
jne 0x477d3f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x477d95
xor ecx, ecx
sub eax, 3
jb 0x477d5b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x477dca
sar eax, 1
mov ebp, eax
jmp 0x477d66
add ebx, ebx
jne 0x477d66
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x477d34
inc ecx
add ebx, ebx
jne 0x477d74
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x477d34
add ebx, ebx
jne 0x477d81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x477d76
jne 0x477d92
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x477d76
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x477db4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x477da6
jmp 0x477cf6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x477db4
add edi, ecx
jmp 0x477cf6
pop esi
mov edi, esi
mov ecx, 0x283d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x477dd2
cmp byte [edi], 0x22
jne 0x477dd2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x477dd7
lea edi, [esi + 0x74000]
mov eax, dword [edi]
or eax, eax
je 0x477e4f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7b620]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7b728]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x477e04
mov ecx, edi
jns 0x477e33
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7b730]
or eax, eax
je 0x477e49
mov dword [ebx], eax
add ebx, 4
jmp 0x477e21
call dword [esi + 0x7b72c]
mov ebp, dword [esi + 0x7b734]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x477e83
sub esp, 0xffffff80
jmp 0x42c2ee
Function at 0x100020cc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 0xc], 0
jne 0x100020e7
call fcn.1000216b
mov dword [ebp + 8], eax
mov dword [ebp - 4], esp
push dword [ebp + 8]
push 0
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
nop
cmp dword [ebp - 4], esp
je 0x1000211d
push 0x92
push 0x401b828
push 6
call fcn.100022b7
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10002151
push 0x92
push 0x401b828
push 6
call fcn.100022b7
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
jmp 0x10002165
mov esp, ebp
pop ebp
ret 8
Function at 0x644dc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1fb000]
push edi
jmp 0x644dda
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x644de1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x644dd0
mov eax, 1
add ebx, ebx
jne 0x644df3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x644e04
jne 0x644e23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x644e23
dec eax
add ebx, ebx
jne 0x644e10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x644de8
add ebx, ebx
jne 0x644e1f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x644e75
xor ecx, ecx
sub eax, 3
jb 0x644e3b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x644eaa
sar eax, 1
mov ebp, eax
jmp 0x644e46
add ebx, ebx
jne 0x644e46
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x644e14
inc ecx
add ebx, ebx
jne 0x644e54
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x644e14
add ebx, ebx
jne 0x644e61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x644e56
jne 0x644e72
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x644e56
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x644e94
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x644e86
jmp 0x644dd6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x644e94
add edi, ecx
jmp 0x644dd6
pop esi
lea edi, [esi + 0x242000]
mov eax, dword [edi]
or eax, eax
je 0x644efc
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2450ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x24516c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x644eb1
mov ecx, edi
jns 0x644ee0
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x245174]
or eax, eax
je 0x644ef6
mov dword [ebx], eax
add ebx, 4
jmp 0x644ece
call dword [esi + 0x245170]
mov ebp, dword [esi + 0x245178]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x644f30
sub esp, 0xffffff80
jmp 0x43aaf6
Function at 0x404b14
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
and dword [esp + 4], 0
push ebx
push esi
push edi
pushal
xor eax, eax
dec eax
xor ebx, eax
mov dword [esp + 0x30], ebx
popal
push str.V3.5_n
call dword [sym.imp.MSVCR90.dll_printf]
cmp dword [0x4093a8], 0
pop ecx
jne 0x404b4d
call fcn.0040435c
cmp dword [0x4093a4], 0
jne 0x404b5b
call fcn.0040429c
call fcn.0040459d
mov esi, dword [ebp + 0xc]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x10]
push eax
push dword [esi]
call fcn.00404144
lea eax, [esp + 0x14]
push eax
call fcn.00403faf
mov dword [0x4093ac], eax
lea eax, [esp + 0x38]
push eax
call fcn.00403f65
push dword [esp + 0xc]
push dword [esi]
call fcn.00404033
push eax
mov dword [0x4093b0], eax
call dword [sym.imp.MSVCR90.dll__msize]
pop ecx
mov esi, eax
push esi
call fcn.00403fe4
mov eax, esi
imul eax, eax, 3
push eax
mov dword [esp + 0x10], eax
call dword [sym.imp.MSVCR90.dll_malloc]
pop ecx
mov edi, eax
push esi
lea eax, [esp + 0x10]
push eax
push edi
call fcn.0040327f
test edi, edi
je 0x404bf3
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x10]
push edi
call fcn.004043b2
lea eax, [esp + 0x38]
push eax
call dword [0x409398]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00404267
int3

Function at 0x401225
Capabilities:
Encode data using xor

Disassembly:
pushal
xor ecx, ecx
add ecx, 0x1000
mov dl, byte [ecx + edi - 1]
rol dl, 1
xor dl, 0x7e
mov byte [ecx + edi - 1], dl
dec ecx
cmp ecx, 0
jne 0x40122e
popal
ret
Function at 0x4028f0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [0x4117bc], eax
sub esp, 0x10
test eax, eax
je 0x402957
mov ebx, dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov edx, eax
jmp 0x402942
mov edx, dword [0x4117bc]
test eax, eax
je 0x402960
mov dword [esp + 4], 0xffffffff
mov dword [esp], edx
call ebx
sub esp, 8
cmp eax, 0xffffffff
jne 0x402938
mov ebx, dword [ebp - 4]
xor eax, eax
leave
ret 4
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_ResetEvent]
sub esp, 4
mov dword [esp + 4], 0
mov dword [esp], sym._EnumWindowsProc_8
call dword [sym.imp.user32.dll_EnumWindows]
mov edx, dword [0x4117bc]
sub esp, 8
jmp 0x402942
Function at 0x403a30
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x54
mov eax, dword [0x4117c0]
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1004
mov dword [esp], eax
call ebx
mov dword [ebp - 0x50], eax
sub esp, 0x10
test eax, eax
jle 0x403b0a
xor esi, esi
jmp 0x403a82
inc esi
cmp dword [ebp - 0x50], esi
je 0x403b0a
xor eax, eax
mov ecx, 0xd
lea edi, [ebp - 0x40]
mov dword [ebp - 0x44], esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0xc
mov dword [esp + 0xc], eax
mov eax, dword [0x4117c0]
mov dword [ebp - 0x38], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 4], 0x104b
mov dword [esp], eax
call ebx
sub esp, 0x10
test byte [ebp - 0x3c], 2
je 0x403a78
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x403b0a
lea edx, [ebp - 0x4c]
mov dword [esp + 4], edx
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowThreadProcessId]
mov eax, dword [0x41185c]
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x1330
mov dword [esp], eax
call ebx
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x403b20
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x50
mov eax, dword [0x4117c0]
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1004
mov dword [esp], eax
call ebx
mov dword [ebp - 0x4c], eax
sub esp, 0x10
test eax, eax
jle 0x403bd3
xor esi, esi
jmp 0x403b66
inc esi
cmp dword [ebp - 0x4c], esi
je 0x403bd3
xor eax, eax
mov ecx, 0xd
lea edi, [ebp - 0x40]
mov dword [ebp - 0x44], esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0xc
mov dword [esp + 0xc], eax
mov eax, dword [0x4117c0]
mov dword [ebp - 0x38], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 4], 0x104b
mov dword [esp], eax
call ebx
sub esp, 0x10
test byte [ebp - 0x3c], 2
je 0x403b60
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x403bd3
mov dword [esp + 4], 1
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.user32.dll_SwitchToThisWindow]
mov eax, dword [0x41161c]
sub esp, 8
test eax, eax
jne 0x403be0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x4117d0]
mov dword [esp + 4], 6
mov dword [esp], eax
call dword [sym.imp.user32.dll_ShowWindow]
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403d90
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x50
mov eax, dword [0x4117c0]
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1004
mov dword [esp], eax
call ebx
mov dword [ebp - 0x4c], eax
sub esp, 0x10
test eax, eax
jle 0x403e44
xor esi, esi
jmp 0x403dd6
inc esi
cmp dword [ebp - 0x4c], esi
je 0x403e44
xor eax, eax
mov ecx, 0xd
lea edi, [ebp - 0x40]
mov dword [ebp - 0x44], esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0xc
mov dword [esp + 0xc], eax
mov eax, dword [0x4117c0]
mov dword [ebp - 0x38], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 4], 0x104b
mov dword [esp], eax
call ebx
sub esp, 0x10
test byte [ebp - 0x3c], 2
je 0x403dd0
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x403e44
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.user32.dll_IsIconic]
sub esp, 4
test eax, eax
jne 0x403e50
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.user32.dll_BringWindowToTop]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 9
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.user32.dll_ShowWindow]
sub esp, 8
jmp 0x403e36
Function at 0x403e70
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [0x4117c0]
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1004
mov dword [esp], eax
call ebx
mov esi, eax
sub esp, 0x10
mov dword [ebp - 0x4c], eax
lea edx, [esi*4]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x54], eax
sub esp, 0xc
test esi, esi
jle 0x403fb0
mov dword [ebp - 0x50], 0
xor esi, esi
mov eax, ebx
mov ebx, esi
mov esi, eax
nop
xor eax, eax
mov ecx, 0xd
lea edi, [ebp - 0x40]
mov dword [ebp - 0x44], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0xc
mov dword [esp + 0xc], eax
mov eax, dword [0x4117c0]
mov dword [ebp - 0x38], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 4], 0x104b
mov dword [esp], eax
call esi
sub esp, 0x10
test byte [ebp - 0x3c], 2
je 0x403f4d
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x403f4d
mov edx, dword [ebp - 0x50]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x54]
mov dword [ecx + edx*4], eax
inc edx
mov dword [ebp - 0x50], edx
inc ebx
cmp dword [ebp - 0x4c], ebx
jne 0x403ef0
mov eax, dword [ebp - 0x50]
mov edi, dword [ebp - 0x54]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 0x10], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.user32.dll_CascadeWindows]
sub esp, 0x14
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x403f56
Function at 0x404140
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [0x4117c0]
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1004
mov dword [esp], eax
call ebx
mov esi, eax
sub esp, 0x10
mov dword [ebp - 0x4c], eax
lea edx, [esi*4]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x54], eax
sub esp, 0xc
test esi, esi
jle 0x404280
mov dword [ebp - 0x50], 0
xor esi, esi
mov eax, ebx
mov ebx, esi
mov esi, eax
nop
xor eax, eax
mov ecx, 0xd
lea edi, [ebp - 0x40]
mov dword [ebp - 0x44], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0xc
mov dword [esp + 0xc], eax
mov eax, dword [0x4117c0]
mov dword [ebp - 0x38], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 4], 0x104b
mov dword [esp], eax
call esi
sub esp, 0x10
test byte [ebp - 0x3c], 2
je 0x40421d
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x40421d
mov edx, dword [ebp - 0x50]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x54]
mov dword [ecx + edx*4], eax
inc edx
mov dword [ebp - 0x50], edx
inc ebx
cmp dword [ebp - 0x4c], ebx
jne 0x4041c0
mov eax, dword [ebp - 0x50]
mov edi, dword [ebp - 0x54]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 0x10], edi
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.user32.dll_TileWindows]
sub esp, 0x14
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x404226
Function at 0x404290
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [0x4117c0]
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1004
mov dword [esp], eax
call ebx
mov esi, eax
sub esp, 0x10
mov dword [ebp - 0x4c], eax
lea edx, [esi*4]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x54], eax
sub esp, 0xc
test esi, esi
jle 0x4043d0
mov dword [ebp - 0x50], 0
xor esi, esi
mov eax, ebx
mov ebx, esi
mov esi, eax
nop
xor eax, eax
mov ecx, 0xd
lea edi, [ebp - 0x40]
mov dword [ebp - 0x44], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0xc
mov dword [esp + 0xc], eax
mov eax, dword [0x4117c0]
mov dword [ebp - 0x38], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 4], 0x104b
mov dword [esp], eax
call esi
sub esp, 0x10
test byte [ebp - 0x3c], 2
je 0x40436d
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x40436d
mov edx, dword [ebp - 0x50]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x54]
mov dword [ecx + edx*4], eax
inc edx
mov dword [ebp - 0x50], edx
inc ebx
cmp dword [ebp - 0x4c], ebx
jne 0x404310
mov eax, dword [ebp - 0x50]
mov edi, dword [ebp - 0x54]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 0x10], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.user32.dll_TileWindows]
sub esp, 0x14
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x404376
Function at 0x408f90
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [esp], 0x4110f4
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x2c
mov dword [esp + 4], 0x411400
mov dword [esp], 0
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
sub esp, 0x10
test eax, eax
leave
sete al
movzx eax, al
ret
Function at 0x40c570
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x250
mov eax, dword [0x4117cc]
mov ebx, dword [sym.imp.user32.dll_LoadStringW]
mov dword [esp + 0xc], 0x1ff
mov dword [esp + 8], 0x4154e0
mov dword [esp + 4], 0x805c
mov dword [esp], eax
call ebx
mov eax, dword [0x4117cc]
sub esp, 0x10
mov dword [esp + 0xc], 0xff
mov dword [esp + 8], 0x414ee0
mov dword [esp + 4], 0x805d
mov dword [esp], eax
call ebx
mov eax, dword [0x4117cc]
sub esp, 0x10
mov dword [esp + 0xc], 0xff
mov dword [esp + 8], 0x4158e0
mov dword [esp + 4], 0x8059
mov dword [esp], eax
call ebx
mov eax, dword [0x411850]
mov esi, dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1004
mov dword [esp], eax
call esi
mov dword [ebp - 0x24c], eax
sub esp, 0x10
test eax, eax
je 0x40c756
lea ebx, [ebp - 0x248]
xor edi, edi
jmp 0x40c641
inc edi
cmp dword [ebp - 0x24c], edi
je 0x40c68f
mov eax, dword [0x411850]
mov dword [ebp - 0x244], edi
mov dword [ebp - 0x248], 8
mov dword [ebp - 0x238], 2
mov dword [ebp - 0x240], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x104b
mov dword [esp], eax
call esi
sub esp, 0x10
test byte [ebp - 0x23c], 2
je 0x40c638
mov eax, dword [0x411850]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1032
mov dword [esp], eax
call esi
sub esp, 0x10
mov ebx, eax
mov dword [esp], edi
call sym._PerfDataGetProcessId
mov esi, eax
cmp ebx, 1
jne 0x40c6f9
test eax, eax
je 0x40c6f9
mov eax, dword [0x4117d0]
mov dword [esp + 0xc], 0x34
mov dword [esp + 8], 0x4158e0
mov ebx, dword [sym.imp.user32.dll_MessageBoxW]
mov dword [esp + 4], 0x4154e0
mov dword [esp], eax
call ebx
sub esp, 0x10
cmp eax, 6
je 0x40c708
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [sym.imp.kernel32.dll_OpenProcess]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x40c796
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
sub esp, 8
test eax, eax
je 0x40c75d
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor edi, edi
jmp 0x40c68f
lea edi, [ebp - 0x20c]
mov dword [esp + 4], 0x100
mov dword [esp], edi
call sym._GetLastErrorText
mov eax, dword [0x4117d0]
mov dword [esp + 4], edi
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x414ee0
mov dword [esp], eax
call ebx
sub esp, 0x10
jmp 0x40c742
lea esi, [ebp - 0x20c]
mov dword [esp + 4], 0x100
mov dword [esp], esi
call sym._GetLastErrorText
mov eax, dword [0x4117d0]
mov dword [esp + 4], esi
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x414ee0
mov dword [esp], eax
call ebx
sub esp, 0x10
jmp 0x40c6f9
Function at 0x40c7f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x254
mov eax, dword [0x411850]
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1004
mov dword [esp], eax
call ebx
mov dword [ebp - 0x24c], eax
sub esp, 0x10
test eax, eax
jne 0x40c841
jmp 0x40c89a
inc esi
cmp dword [ebp - 0x24c], esi
je 0x40c89a
xor eax, eax
mov ecx, 0xd
lea edi, [ebp - 0x240]
mov dword [ebp - 0x248], 8
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x248]
mov dword [ebp - 0x244], esi
mov dword [esp + 0xc], eax
mov eax, dword [0x411850]
mov dword [ebp - 0x238], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x104b
mov dword [esp], eax
call ebx
sub esp, 0x10
test byte [ebp - 0x23c], 2
je 0x40c838
mov eax, dword [0x411850]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1032
mov dword [esp], eax
call ebx
sub esp, 0x10
mov ebx, eax
mov dword [esp], esi
call sym._PerfDataGetProcessId
cmp ebx, 1
jne 0x40c948
test eax, eax
je 0x40c948
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x600
call dword [sym.imp.kernel32.dll_OpenProcess]
mov dword [0x41183c], eax
sub esp, 0xc
test eax, eax
je 0x40c950
mov eax, dword [0x4117d0]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], sym._AffinityDialogWndProc_16
mov dword [esp + 8], eax
mov eax, dword [0x4117cc]
mov dword [esp + 4], 0x8e
mov dword [esp], eax
call dword [sym.imp.user32.dll_DialogBoxParamW]
mov eax, dword [0x41183c]
sub esp, 0x14
test eax, eax
je 0x40c948
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [0x41183c], 0
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebx, [ebp - 0x20c]
mov dword [esp + 4], 0x100
mov dword [esp], ebx
call sym._GetLastErrorText
mov eax, dword [0x4117cc]
mov dword [esp + 0xc], 0xff
mov dword [esp + 8], 0x414ce0
mov dword [esp + 4], 0x8062
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
mov eax, dword [0x4117d0]
sub esp, 0x10
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], 0x414ce0
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.user32.dll_MessageBoxW]
sub esp, 0x10
jmp 0x40c948