joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461adc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4c9be4]
cmp dword [eax + 0x30], 0
je 0x461b86
cmp dword [ebx + 0x94], 0
jne 0x461b80
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x461a6c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x461b80
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x461b46
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x461b80
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00419f90
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x461b55
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4626e8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x46271d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004047a8
jmp 0x46272a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040470c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x46378c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4637cd
mov eax, esi
call fcn.00449e34
test al, al
je 0x4637cd
mov eax, dword [ebx + 0x84]
call fcn.00449b30
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4637cd
push 0
mov eax, dword [ebx + 0x84]
call fcn.00449b30
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x46448c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x416e60]
call fcn.00405098
xor eax, eax
push ebp
push 0x4645d0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4c3f74], 0
jne 0x4644df
mov ecx, dword [0x4c7c68]
mov dl, 1
mov eax, dword [0x407ba0]
call fcn.0040cfa8
call fcn.00404050
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004030b0
mov eax, ebx
call fcn.00404f48
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4645e0
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406130
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404f58
test eax, eax
jle 0x464577
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x464570
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404940
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404928
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408b24
test eax, eax
jne 0x464570
mov ebx, 0x15
jmp 0x46457c
mov ebx, 0x10
jmp 0x46457c
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4c3f74]
call fcn.004643e4
mov eax, dword [ebp - 8]
call fcn.004643e4
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406148
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4645d7
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004046dc
lea eax, [ebp - 0x10]
mov edx, dword [0x416e60]
call fcn.00405168
ret
Function at 0x478820
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x478828
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4789f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x478a10
mov eax, esi
call fcn.00476408
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.0040470c
lea ecx, [ebp - 0x10]
mov edx, 0x478a24
mov eax, esi
call fcn.00476408
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.0040470c
lea ecx, [ebp - 0x14]
mov edx, 0x478a3c
mov eax, esi
call fcn.00476408
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.0040470c
lea ecx, [ebp - 0x18]
mov edx, 0x478a58
mov eax, esi
call fcn.00476408
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.0040470c
lea ecx, [ebp - 0x1c]
mov edx, 0x478a74
mov eax, esi
call fcn.00476408
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.0040470c
lea ecx, [ebp - 0x24]
mov edx, 0x478a8c
mov eax, esi
call fcn.00476408
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408b94
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.004090dc
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x478aa4
mov eax, esi
call fcn.00476408
mov eax, dword [ebp - 0x28]
call fcn.0046fee0
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x478ab4
mov eax, esi
call fcn.00476408
mov eax, dword [ebp - 0x2c]
call fcn.0046fee0
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x478acc
mov eax, esi
call fcn.00476408
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.004090dc
inc eax
je 0x4789ba
lea ecx, [ebp - 0x34]
mov edx, 0x478acc
mov eax, esi
call fcn.00476408
mov eax, dword [ebp - 0x34]
call fcn.004090a0
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a648
fstp qword [ebp - 0x3c]
wait
call fcn.0040a9ac
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x40]
mov edx, 0x478adc
mov eax, esi
call fcn.00476408
mov edx, dword [ebp - 0x40]
lea eax, [ebx + 0x48]
call fcn.0040470c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4789fe
lea eax, [ebp - 0x40]
call fcn.004046b8
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004046dc
ret
Function at 0x47f78c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x47f7e6
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0047f77c
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.0046ea50
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.0046e650
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f7ed
lea eax, [ebp - 4]
call fcn.004046b8
ret

Function at 0x485ee0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x485f0e
mov eax, ebx
call fcn.00486994
cmp dword [ebx + 0x40], 0
je 0x485f07
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x485f7f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x485f71
cmp dword [ebx + 8], 0
je 0x485f30
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x485f42
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x485f71
cmp dword [ebx + 8], 0
je 0x485f23
cmp eax, 3
je 0x485f55
dec eax
jne 0x485f23
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x485f23
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x485f23
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x485f9d
cmp dword [ebx + 0x14], 0xcc
je 0x485f9d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00485fa8
pop ebx
ret

Function at 0x4983b4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x498405
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4983ec
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4983dc
jmp 0x498405
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4983ed
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a58d4
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
call fcn.0041a354
mov esi, eax
xor eax, eax
push ebp
push 0x4a594e
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [esi + 8]
dec ebx
cmp ebx, 0
jl 0x4a5932
mov edx, ebx
mov eax, esi
call fcn.00419f90
test byte [eax + 0x58], 1
je 0x4a592c
push 0
mov edx, ebx
mov eax, esi
call fcn.00419f90
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_TerminateThread
mov edx, ebx
mov eax, esi
call fcn.00419e80
dec ebx
cmp ebx, 0xffffffff
jne 0x4a5900
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5955
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
call fcn.0041a3b8
ret

Function at 0x4a5f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
test edx, edx
je 0x4a5f7d
cmp dword [ebp - 4], 0
je 0x4a5f7d
test eax, eax
ja 0x4a5f81
xor eax, eax
jmp 0x4a5fc7
mov esi, 0x11cfd
dec eax
test eax, eax
jb 0x4a5fc5
inc eax
xor edi, edi

Function at 0x4a5fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
test edx, edx
je 0x4a5fec
cmp dword [ebp - 4], 0
je 0x4a5fec
test eax, eax
ja 0x4a5ff0
xor eax, eax
jmp 0x4a602f
mov esi, 0x11cfd
dec eax
test eax, eax
jb 0x4a602d
inc eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov cl, byte [edx + eax]
mov byte [ebp - 5], cl
mov ebx, esi
shr ebx, 8
xor bl, cl
mov ecx, dword [ebp - 4]
mov byte [ecx + eax], bl
movsx ecx, byte [ebp - 5]
add esi, ecx
imul ecx, esi, 0xce6d
add ecx, 0x58bf
mov esi, ecx
inc eax
dec dword [ebp - 0xc]
jne 0x4a6000
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a6d10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
test edi, edi
jne 0x4a6d3a
cmp dword [ebx + 0x64], 0
jne 0x4a6d3a
cmp dword [ebx + 0x6c], 0
jne 0x4a6d3a
mov edi, esi
jmp 0x4a6dc1
cmp edi, 0xffffffff
jne 0x4a6d42
dec edi
jmp 0x4a6dc1
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x4a6dc1
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004a610c
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4a6d8f
mov cx, word [esp]
sub cx, si
jmp 0x4a6d91
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4a6d78
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4a6db7
mov cx, word [esp]
sub cx, si
jmp 0x4a6db9
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4a6da0
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4a6e1e
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.004a6aac
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x4a6e09
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x4a6e1e
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4a6d1a
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4ad074
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4c9fc0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4ad096
shr eax, 1
xor eax, 0xedb88320
jmp 0x4ad098
shr eax, 1
dec edx
jne 0x4ad084
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4ad07d
mov byte [0x4ca3c0], 1
pop esi
pop ebx
ret

Function at 0x4ad0b4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4ca3c0], 0
jne 0x4ad0cb
call fcn.004ad074
mov eax, edi
dec eax
test eax, eax
jl 0x4ad0f4
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4c9fc0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4ad0d5
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4af644
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4af675
dec al
je 0x4af6b1
dec al
je 0x4af6f5
dec al
je 0x4af760
jmp 0x4af7ea
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4af7ea
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4af685
jmp 0x4af7ea
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4af7ea
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4af6c1
jmp 0x4af7ea
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4af7ea
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4af723
xor ebp, ebp
jmp 0x4af734
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4af73d
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4af705
jmp 0x4af7ea
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4af7ea
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4af7b8
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004ad0fc
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4af774
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4b2adc
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b2b67
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x1400
mov eax, dword [ebp - 4]
call fcn.0040278c
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
je 0x4b2b24
push eax
call sub.kernel32.dll_SetLastError
call fcn.0040e8f4
mov ebx, edi
lea ecx, [ebp - 8]
lea eax, [ebx + 0x194]
mov edx, dword [ebx + 0x190]
call fcn.004b2a48
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00404980
mov ebx, dword [ebx]
test ebx, ebx
jne 0x4b2b26
mov eax, edi
call fcn.004027ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b2b6e
lea eax, [ebp - 8]
call fcn.004046b8
ret

Function at 0x4b3470
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.0040757c
ret
Function at 0x10001090
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100010eb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100010eb
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x100010d8
cmp esi, edx
jae 0x100010eb
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x100010c6
cmp esi, edx
jae 0x100010eb
xor eax, eax
cmp word [esi], ax
pop edi
cmove esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x10001d60
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xf4
mov eax, dword [0x1000700c]
xor eax, esp
mov dword [esp + 0xf0], eax
push esi
mov dword [esp + 8], 0x1b
xor eax, eax
mov dword [esp + 0xc], 0x73000b
mov dword [esp + 0x10], 0x1c0016
mov dword [esp + 0x14], 0x230025
mov dword [esp + 0x18], 0x20002a
mov dword [esp + 0x1c], 0x220027
mov dword [esp + 0x20], 0xe
mov dword [esp + 0x24], 0x26002d
mov dword [esp + 0x28], 0x320022
mov dword [esp + 0x2c], 0x6a0035
mov dword [esp + 0x30], 0x70068
mov dword [esp + 0x34], 0x340034
mov dword [esp + 0x38], 0x71003a
mov dword [esp + 0x3c], 0xd0004
mov dword [esp + 0x40], 0x63000e
lea ecx, [eax + 0x48]
xor word [esp + eax*2 + 0xc], cx
inc eax
mov ecx, dword [esp + 8]
cmp eax, ecx
jb 0x10001df5
xor eax, eax
push 8
push eax
mov word [esp + ecx*2 + 0x14], ax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call fcn.10001b00
lea ecx, [esp + 0x44]
call fcn.10001840
mov esi, eax
test esi, esi
je 0x10001e96
push 0
push fcn.10001ca0
push 0x10002a90
push 0x10002a90
push 0x10002a90
lea eax, [esp + 0x5c]
push 0x10002a90
push eax
call fcn.10001cf0
push 0
lea eax, [esp + 0x68]
push 0x10002ab0
push eax
call fcn.10001d20
mov edx, dword [esp + 0x6c]
lea eax, [esp + 0x70]
add esp, 0x28
mov ecx, esi
push eax
sub esp, 0xc
push 0x10001cd0
push 0x10001cb0
call fcn.10002b10
mov ecx, eax
call fcn.10003000
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 0x1c
mov ecx, dword [esp + 0xf4]
pop esi
xor ecx, esp
call fcn.100031ac
mov esp, ebp
pop ebp
ret

Function at 0x10001eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
sub dword [ebp + 0xc], 1
jne 0x10001f2a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov dword [ebp - 0x1c], 0xb
xor eax, eax
mov dword [ebp - 0x18], 0x3d001b
mov dword [ebp - 0x14], 0x2a002f
mov dword [ebp - 0x10], 0x180021
mov dword [ebp - 0xc], 0x610007
mov dword [ebp - 8], 0x3d0034
mov dword [ebp - 4], 0x53003e
nop dword [eax + eax]
lea ecx, [eax + 0x48]
xor word [ebp + eax*2 - 0x18], cx
inc eax
mov ecx, dword [ebp - 0x1c]
cmp eax, ecx
jb 0x10001f00
xor eax, eax
mov word [ebp + ecx*2 - 0x18], ax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10001f2a
call fcn.10001d60
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x7b1e31ca
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..text_1
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x6f757126
nop
nop
nop
nop
test eax, eax
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x413200
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.EYZtqSKO
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x413222
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x413229
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x413218
mov eax, 1
add ebx, ebx
jne 0x41323b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x413230
jne 0x41324c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413230
xor ecx, ecx
sub eax, 3
jb 0x413260
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4132d2
mov ebp, eax
add ebx, ebx
jne 0x41326b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x413278
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41329c
inc ecx
add ebx, ebx
jne 0x413288
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41327d
jne 0x413299
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41327d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4132bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4132ad
jmp 0x41321e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4132bc
add edi, ecx
jmp 0x41321e
pop esi
lea edi, [esi + 0x11000]
mov eax, dword [edi]
or eax, eax
je 0x41331b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x130b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1311c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4132d9
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13124]
or eax, eax
je 0x413315
mov dword [ebx], eax
add ebx, 4
jmp 0x4132f6
call dword [esi + 0x13120]
mov ebp, dword [esi + 0x13128]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41334f
sub esp, 0xffffff80
jmp section.WZqkObwJ