joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404608
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x42199c], 0
jne 0x40463b
push ebx
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.0040426f
push dword [eax]
call fcn.004045e7
push dword [ebp - 0xc]
mov bl, al
call fcn.00403149
pop ecx
mov al, bl
pop ebx
jmp 0x404657
push 0
push dword [ebp + 8]
call fcn.00404223
test al, al
je 0x404657
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
leave
ret 4

Function at 0x4048f3
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4186a8
call fcn.00417bb0
sub esp, 0x18
push ebx
xor ebx, ebx
cmp byte [0x42199c], bl
je 0x40495f
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0x105
cmp dword [esi + 8], edi
jg 0x404926
push 0x106
mov ecx, esi
call fcn.004021d8
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, dword [esi]
xor edx, edx
cmp word [ecx], bx
je 0x404942
mov edi, ecx
inc edx
inc edi
inc edi
cmp word [edi], bx
jne 0x40493a
mov word [ecx + edx*2], bx
mov dword [esi + 4], edx
pop edi
cmp eax, ebx
pop esi
jbe 0x40495b
cmp eax, 0x104
ja 0x40495b
push 1
pop eax
jmp 0x4049b2
xor eax, eax
jmp 0x4049b2
push 0xf
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00402d20
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ebx
push eax
call fcn.004048ad
test al, al
je 0x4049a7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00404160
mov ecx, dword [ebp + 8]
push eax
mov byte [ebp - 4], 1
call fcn.00401c7c
push dword [ebp - 0x24]
call fcn.00403149
pop ecx
mov bl, 1
push dword [ebp - 0x18]
call fcn.00403149
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x404c9b
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x418700
call fcn.00417bb0
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 1
mov eax, dword [esi]
push 0
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
push 0
mov dword [edi + 0x18], eax
push dword [esi + 0x1c]
call fcn.00417d30
mov ecx, dword [esi + 0x20]
xor ebx, ebx
add eax, ecx
lea ecx, [ebp - 0x18]
mov dword [edi + 0x20], eax
lea eax, [esi + 0x2c]
adc edx, ebx
push eax
mov dword [edi + 0x24], edx
call fcn.00402cd9
and dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
neg eax
sbb eax, eax
inc eax
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00404d54
push eax
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 1
call fcn.00401c7c
push dword [ebp - 0x24]
call fcn.00403149
push dword [ebp - 0x18]
call fcn.00403149
mov eax, dword [esi + 0x24]
pop ecx
pop ecx
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x404f00
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x404f26
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x404f26
xor al, al
jmp 0x404f46
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00417d30
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x405b16
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, ecx
push edi
mov eax, dword [esi]
and dword [esi + 4], 0
and byte [eax], 0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edi, eax
test edi, edi
jne 0x405b43
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
inc eax
jmp 0x405b7d
cmp edi, dword [esi + 8]
jl 0x405b53
lea eax, [edi + 1]
mov ecx, esi
push eax
call fcn.00402d20
mov eax, dword [esi]
inc edi
push edi
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, esi
mov edi, eax
call fcn.004049c1
test edi, edi
jne 0x405b7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
neg eax
jmp 0x405b7d
mov al, 1
pop edi
pop esi
pop ebx
ret 4

Function at 0x405b83
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x418868
call fcn.00417bb0
sub esp, 0x18
cmp byte [0x42199c], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x405c07
mov esi, dword [ebp + 8]
mov eax, dword [esi]
and dword [esi + 4], 0
and word [eax], 0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
test edi, edi
je 0x405bf6
cmp edi, dword [esi + 8]
jl 0x405bc9
lea eax, [edi + 1]
mov ecx, esi
push eax
call fcn.004021d8
mov eax, dword [esi]
inc edi
push edi
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi]
xor ebx, ebx
xor edx, edx
cmp word [ecx], bx
je 0x405beb
mov edi, ecx
inc edx
inc edi
inc edi
cmp word [edi], bx
jne 0x405be3
mov word [ecx + edx*2], bx
cmp eax, ebx
mov dword [esi + 4], edx
jne 0x405c03
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
inc eax
jmp 0x405c5a
mov al, 1
jmp 0x405c5a
xor esi, esi
push 0xf
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call fcn.00402d20
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
mov dword [ebp - 4], esi
call fcn.00405b16
mov bl, al
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00402bb2
mov ecx, dword [ebp + 8]
push eax
mov byte [ebp - 4], 1
call fcn.00401c7c
push dword [ebp - 0x24]
call fcn.00403149
push dword [ebp - 0x18]
call fcn.00403149
pop ecx
mov al, bl
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x409bcc
Capabilities:
Get process heap flags

Disassembly:
mov eax, 0x418e5a
call fcn.00417bb0
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
mov al, byte [esi]
lea ecx, [ebx + 8]
mov byte [ebx], al
mov al, byte [esi + 1]
mov byte [ebx + 1], al
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
lea eax, [esi + 8]
push eax
call fcn.00401d76
mov al, byte [esi + 0x14]
and dword [ebp - 4], 0
mov byte [ebx + 0x14], al
lea eax, [esi + 0x18]
push eax
lea ecx, [ebx + 0x18]
call fcn.00401d76
lea eax, [esi + 0x28]
lea edx, [ebx + 0x28]
push 0xc
mov esi, eax
pop ecx
mov edi, edx
rep movsd dword es:[edi], dword [esi]
add eax, 0x30
lea ecx, [edx + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.00401d76
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, dword [eax + 0x68]
mov dword [ebx + 0x68], eax
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x40c912
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x419467
call fcn.00417bb0
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
push 8
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
pop edi
mov edx, 0x41b750
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x41b8bc
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call fcn.00403468
push dword [esi + 8]
mov ecx, ebx
call fcn.00403468
push dword [esi + 0xc]
mov ecx, edi
call fcn.00403468
push dword [esi + 0xc]
mov ecx, edi
call fcn.00403468
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x40c91e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x419467
call fcn.00417bb0
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
push 8
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
pop edi
mov edx, 0x41b750
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x41b8bc
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call fcn.00403468
push dword [esi + 8]
mov ecx, ebx
call fcn.00403468
push dword [esi + 0xc]
mov ecx, edi
call fcn.00403468
push dword [esi + 0xc]
mov ecx, edi
call fcn.00403468
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x416175
Capabilities:
Hash data using sha256

Disassembly:
and dword [ecx + 0x20], 0
and dword [ecx + 0x24], 0
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
ret
Function at 0x417055
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
xor ecx, ecx
test eax, eax
setne cl
push ecx
call fcn.0041701f
pop ebp
ret 0xc

Function at 0x4171ad
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov edx, dword [ecx]
and edx, 7
cmp dword [ebp + 0xc], 5
jb 0x4172fd
add dword [ebp + 0x10], 5
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
mov ecx, dword [ebp + 8]
lea esi, [eax + ecx]
mov eax, dword [ebp + 0xc]
lea edi, [ecx + eax - 4]
cmp esi, edi
jae 0x4171ed
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x4171ed
inc esi
jmp 0x4171de
mov eax, esi
sub eax, ecx
cmp esi, edi
mov dword [ebp - 8], eax
jae 0x4172dd
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x417222
xor edx, edx
mov cl, byte [esi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x41724f
cmp cl, 0xff
je 0x41724f
and edx, 3
shl edx, 1
or edx, 1
inc eax
jmp 0x4171d1
dec ecx
shl edx, cl
and edx, 7
je 0x417208
movzx ecx, byte [edx + 0x41bdac]
mov edi, esi
sub edi, ecx
cmp byte [edx + 0x41bda4], 0
mov cl, byte [edi + 4]
je 0x41724a
test cl, cl
je 0x41724a
cmp cl, 0xff
jne 0x417208
mov dword [ebp - 4], eax
jmp 0x417217
xor ebx, ebx
mov bh, cl
mov bl, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
mov edi, ebx
cmp dword [ebp + 0x18], 0
je 0x417278
lea ebx, [edi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x41727f
sub edi, eax
sub edi, dword [ebp + 0x10]
mov ebx, edi
test edx, edx
je 0x4172b3
movzx edi, byte [edx + 0x41bdac]
push 0x18
mov eax, ebx
shl edi, 3
pop ecx
sub ecx, edi
shr eax, cl
test al, al
je 0x41729e
cmp al, 0xff
jne 0x4172b0
push 0x20
mov eax, dword [ebp - 8]
pop ecx
push 1
sub ecx, edi
pop edi
shl edi, cl
dec edi
xor edi, ebx
jmp 0x41726a
mov eax, dword [ebp - 8]
mov ecx, ebx
mov byte [esi + 1], bl
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [esi + 2], cl
add eax, 5
jmp 0x4171d1
mov esi, eax
push 3
sub esi, dword [ebp - 4]
pop edi
lea ecx, [esi - 1]
shl edx, cl
and edx, 7
cmp edi, esi
sbb ecx, ecx
pop edi
not ecx
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
pop ebx
mov dword [edx], ecx
leave
ret 0x14
Function at 0x41753c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
shr ebx, 2
and dword [ebp - 4], 0
mov eax, ebx
shr eax, 1
add eax, 3
push esi
mov dword [ecx], eax
push edi
lea eax, [eax*8 + 4]
mov dword [ebp + 8], ebx
test ebx, ebx
mov dword [ebp - 0xc], eax
lea esi, [ecx + 4]
jbe 0x41759a
mov edi, esi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
movzx ecx, byte [edx + 1]
xor eax, eax
mov ah, byte [edx + 3]
mov al, byte [edx + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx]
shl eax, 8
or eax, ecx
add edx, 4
mov dword [edi], eax
add edi, 4
dec dword [ebp - 8]
jne 0x417574
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jae 0x417679
mov edi, eax
mov eax, ebx
shl edi, 2
shl eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
xor edx, edx
div ebx
mov ecx, dword [edi + esi - 4]
mov dword [ebp - 8], ecx
test edx, edx
jne 0x417614
mov eax, ecx
xor ebx, ebx
and eax, 0xff
mov bh, byte [eax + str.cw]
mov eax, ecx
shr eax, 0x18
mov bl, byte [eax + str.cw]
xor eax, eax
mov al, byte [ebp - 6]
shl ebx, 8
movzx eax, byte [eax + str.cw]
or ebx, eax
xor eax, eax
mov al, ch
shl ebx, 8
movzx ecx, byte [eax + str.cw]
mov eax, dword [ebp - 4]
div dword [ebp + 8]
movzx eax, byte [eax + 0x421960]
xor ecx, eax
or ecx, ebx
mov ebx, dword [ebp + 8]
jmp 0x41765a
cmp ebx, 6
jbe 0x41765a
cmp edx, 4
jne 0x41765a
xor eax, eax
xor edx, edx
mov al, byte [ebp - 6]
mov dl, byte [eax + str.cw]
mov eax, ecx
shr eax, 0x18
mov dh, byte [eax + str.cw]
xor eax, eax
mov al, ch
and ecx, 0xff
shl edx, 8
movzx eax, byte [eax + str.cw]
or edx, eax
movzx eax, byte [ecx + str.cw]
shl edx, 8
or edx, eax
mov ecx, edx
mov eax, edi
sub eax, dword [ebp - 0x10]
mov eax, dword [eax + esi]
xor eax, ecx
inc dword [ebp - 4]
mov dword [edi + esi], eax
mov eax, dword [ebp - 4]
add edi, 4
cmp eax, dword [ebp - 0xc]
jb 0x4175b3
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x417680
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [ebp + 8]
call fcn.0041753c
mov eax, dword [esi]
lea ecx, [esi + 0x14]
lea eax, [eax*8 - 4]
test eax, eax
jbe 0x4176fc
push ebx
push edi
mov esi, eax
mov eax, dword [ecx]
xor edx, edx
mov dword [ebp + 8], eax
xor ebx, ebx
mov dl, byte [ebp + 0xa]
mov bl, ah
movzx edx, byte [edx + str.cw]
movzx edi, byte [ebx + str.cw]
mov edx, dword [edx*4 + 0x4223a0]
xor edx, dword [edi*4 + 0x421fa0]
mov edi, eax
shr edi, 0x18
and eax, 0xff
movzx edi, byte [edi + str.cw]
movzx eax, byte [eax + str.cw]
xor edx, dword [edi*4 + 0x4227a0]
xor edx, dword [eax*4 + 0x421ba0]
mov dword [ecx], edx
add ecx, 4
dec esi
jne 0x4176a2
pop edi
pop ebx
pop esi
pop ebp
ret 4
Function at 0x417af8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
mov edi, edx
mov esi, ecx
jne 0x417b13
xor eax, eax
jmp 0x417b94
push 0x10
pop eax
cmp ebx, eax
jb 0x417b94
sub ebx, eax
add ebx, eax
shr ebx, 4
mov eax, ebx
shl eax, 4
mov dword [ebp + 8], eax
mov eax, dword [edi]
push dword [esi + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 8]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 4], eax
lea eax, [esi + 0x14]
push eax
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x10]
call fcn.00417701
mov eax, dword [esi]
xor eax, dword [ebp - 0x20]
mov dword [edi], eax
mov eax, dword [esi + 4]
xor eax, dword [ebp - 0x1c]
add edi, 0x10
mov dword [edi - 0xc], eax
mov eax, dword [esi + 8]
xor eax, dword [ebp - 0x18]
mov dword [edi - 8], eax
mov eax, dword [esi + 0xc]
xor eax, dword [ebp - 0x14]
dec ebx
mov dword [edi - 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp - 8]
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
mov dword [esi + 0xc], eax
jne 0x417b29
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x417f60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov eax, ecx
mov esi, edx
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
test edi, edi
je 0x417f8f
test esi, 7
je 0x417f8f
movzx edx, byte [esi]
inc esi
movzx ebx, al
xor edx, ebx
shr eax, 8
xor eax, dword [ebp + edx*4]
dec edi
jne 0x417f74
cmp edi, 0x10
jb 0x418018
mov dword [esp + 0x14], edi
sub edi, 8
and edi, 0xfffffff8
sub dword [esp + 0x14], edi
add edi, esi
xor eax, dword [esi]
mov ebx, dword [esi + 4]
movzx ecx, bl
mov edx, dword [ebp + ecx*4 + 0xc00]
movzx ecx, bh
xor edx, dword [ebp + ecx*4 + 0x800]
shr ebx, 0x10
movzx ecx, bl
xor edx, dword [ebp + ecx*4 + 0x400]
xor edx, dword [esi + 8]
movzx ecx, al
movzx ebx, bh
xor edx, dword [ebp + ebx*4]
mov ebx, dword [esi + 0xc]
xor edx, dword [ebp + ecx*4 + 0x1c00]
movzx ecx, ah
add esi, 8
shr eax, 0x10
xor edx, dword [ebp + ecx*4 + 0x1800]
movzx ecx, al
xor edx, dword [ebp + ecx*4 + 0x1400]
movzx ecx, ah
mov eax, dword [ebp + ecx*4 + 0x1000]
movzx ecx, bl
xor eax, edx
cmp esi, edi
jne 0x417fb0
xor eax, dword [esi]
mov edi, dword [esp + 0x14]
test edi, edi
je 0x41802f
movzx edx, byte [esi]
inc esi
movzx ebx, al
xor edx, ebx
shr eax, 8
xor eax, dword [ebp + edx*4]
dec edi
jne 0x41801c
pop ebp
pop edi
pop esi
pop ebx
ret 8
Function at 0x401968
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411284]
jne 0x401972
repz ret
jmp fcn.00402da4

Function at 0x40998a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x411284]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004042bf
and dword [ebp - 0x14], 0
cmp dword [0x412b44], 0
mov dword [ebp - 0x18], eax
jne 0x409a3d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x409ae5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x409ae5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x412b44], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x412b48], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x412b4c], eax
call edi
push eax
call esi
mov dword [0x412b54], eax
test eax, eax
je 0x409a3d
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x412b50], eax
mov eax, dword [0x412b50]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x409a96
cmp dword [0x412b54], ecx
je 0x409a96
push eax
call esi
push dword [0x412b54]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x409a96
test ebx, ebx
je 0x409a96
call edi
test eax, eax
je 0x409a8d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x409a8d
test byte [ebp - 8], 1
jne 0x409a96
or dword [ebp + 0x10], 0x200000
jmp 0x409ac9
mov eax, dword [0x412b48]
cmp eax, dword [ebp - 0x18]
je 0x409ac9
push eax
call esi
test eax, eax
je 0x409ac9
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x409ac9
mov eax, dword [0x412b4c]
cmp eax, dword [ebp - 0x18]
je 0x409ac9
push eax
call esi
test eax, eax
je 0x409ac9
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x412b44]
call esi
test eax, eax
je 0x409ae5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x409ae7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401968
leave
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x39e42b17
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0xddc458b
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp int.00401219

Function at 0x411ab0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0xb000]
push edi
or ebp, 0xffffffff
jmp 0x411ad2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x411ad9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x411ac8
mov eax, 1
add ebx, ebx
jne 0x411aeb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x411ae0
jne 0x411afc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411ae0
xor ecx, ecx
sub eax, 3
jb 0x411b10
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x411b82
mov ebp, eax
add ebx, ebx
jne 0x411b1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x411b28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x411b4c
inc ecx
add ebx, ebx
jne 0x411b38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x411b2d
jne 0x411b49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411b2d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x411b6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x411b5d
jmp 0x411ace
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x411b6c
add edi, ecx
jmp 0x411ace
pop esi
mov edi, esi
mov ecx, 0x203
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x411b8a
cmp byte [edi], 0xa
jne 0x411b8a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x411b8f
lea edi, [esi + 0xf000]
mov eax, dword [edi]
or eax, eax
je 0x411bfe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x113a4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11408]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x411bbc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1140c]
or eax, eax
je 0x411bf8
mov dword [ebx], eax
add ebx, 4
jmp 0x411bd9
call dword [esi + 0x11410]
popal
jmp 0x403ae7