joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006120
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10006138
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x10017744]
test eax, eax
je 0x10006131
cmp dword [0x10017748], 0
jne 0x1000623d
xor eax, eax
push esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov word [ebp - 4], ax
mov byte [ebp - 2], al
lea eax, [ebp - 0xc]
push eax
push 4
push 0xb
push 0x10013890
mov eax, 0x1001388c
call fcn.10006880
push 0x104
lea ecx, [ebp - 0x110]
push 0
push ecx
call sub.msvcrt.dll_memset
mov eax, 0x7ffe0030
add esp, 0x1c
xor esi, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10006195
sub eax, edx
sar eax, 1
jne 0x100061ae
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, ebx
push edi
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x100061b4
sub ecx, edi
lea ecx, [eax + ecx + 0xc]
xor eax, eax
pop edi
cmp ecx, 0x104
ja 0x100061a8
test ecx, ecx
je 0x100061ef
cmp word [eax + eax + 0x7ffe0030], 0
je 0x100061ef
mov dl, byte [eax + eax + 0x7ffe0030]
mov byte [ebp + eax - 0x110], dl
inc eax
inc esi
cmp eax, ecx
jb 0x100061d0
xor eax, eax
test ecx, ecx
je 0x1000620a
mov dl, byte [ebp + eax - 0xc]
test dl, dl
je 0x1000620a
mov byte [ebp + esi - 0x110], dl
inc eax
inc esi
cmp eax, ecx
jb 0x100061f5
xor eax, eax
test ecx, ecx
je 0x10006226
lea esi, [ebp + esi - 0x110]
mov dl, byte [eax + ebx]
test dl, dl
je 0x10006226
mov byte [esi], dl
inc eax
inc esi
cmp eax, ecx
jb 0x10006217
push 8
push 0
lea eax, [ebp - 0x110]
push eax
call dword [0x10017744]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x800
push 0
push ebx
call eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006430
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
xor eax, eax
push ebx
push esi
push edi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov word [ebp - 0x3c], ax
lea eax, [ebp - 0x54]
push eax
push 4
push 0x1a
push 0x10014928
mov eax, 0x10014924
xor ebx, ebx
call fcn.10006880
lea ecx, [ebp - 0x7c]
push ecx
xor eax, eax
push 4
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
push 0x10
push 0x10013908
mov eax, 0x10013904
call fcn.10006880
lea edx, [ebp - 0x10]
push edx
xor eax, eax
push 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov word [ebp - 4], ax
push 0xe
push 0x1001391c
mov eax, 0x10013918
call fcn.10006880
xor eax, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x38]
push eax
push 4
push 0x12
push 0x10013930
mov eax, 0x1001392c
call fcn.10006880
add esp, 0x40
xor eax, eax
lea ecx, [ebp - 0x24]
push ecx
push 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], al
push 0x11
push 0x10013948
mov eax, 0x10013944
call fcn.10006880
xor eax, eax
lea edx, [ebp - 0x6c]
push edx
push 4
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], al
push 0x15
push 0x10013960
mov eax, 0x1001395c
call fcn.10006880
xor eax, eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x90]
push eax
push 4
push 0x14
push 0x1001397c
mov eax, 0x10013978
call fcn.10006880
add esp, 0x30
lea ecx, [ebp - 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x10006593
lea ecx, [ebp - 0x54]
call fcn.1000a060
mov esi, eax
test esi, esi
je 0x1000661b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [ebp - 0x6c]
push edx
push esi
call edi
mov dword [0x10017760], eax
test eax, eax
je 0x1000661b
lea eax, [ebp - 0x90]
push eax
push esi
call edi
mov dword [0x10017764], eax
test eax, eax
je 0x1000661b
lea ecx, [ebp - 0x7c]
push ecx
push esi
call edi
mov dword [0x1001774c], eax
test eax, eax
je 0x1000661b
lea edx, [ebp - 0x10]
push edx
push esi
call edi
mov dword [0x10017754], eax
test eax, eax
je 0x1000661b
lea eax, [ebp - 0x38]
push eax
push esi
call edi
mov dword [0x10017758], eax
test eax, eax
je 0x1000661b
lea ecx, [ebp - 0x24]
push ecx
push esi
call edi
mov dword [0x1001775c], eax
test eax, eax
je 0x1000661b
push 0xf0000040
push 1
push 0
push 0
push 0x10017768
call dword [0x10017760]
test eax, eax
je 0x1000661b
mov ebx, 1
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006880
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push esi
push edi
push 0x100
mov edi, eax
lea eax, [ebp - 0x100]
push 0
push eax
call sub.msvcrt.dll_memset
xor esi, esi
add esp, 0xc
cmp dword [ebp + 8], esi
je 0x1000698a
test edi, edi
je 0x1000698a
cmp dword [ebp + 0x14], esi
je 0x1000698a
xor eax, eax
mov byte [ebp + eax - 0x100], al
inc eax
cmp eax, 0x100
jb 0x100068c1
xor ecx, ecx
push ebx
xor edx, edx
mov eax, ecx
div dword [ebp + 0x10]
movzx ebx, byte [ebp + ecx - 0x100]
inc ecx
movzx edx, byte [edx + edi]
add edx, ebx
add esi, edx
and esi, 0xff
mov al, byte [ebp + esi - 0x100]
mov byte [ebp + ecx - 0x101], al
mov byte [ebp + esi - 0x100], bl
cmp ecx, 0x100
jb 0x100068d3
mov eax, dword [ebp + 0xc]
xor esi, esi
xor edi, edi
test eax, eax
je 0x10006989
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
sub edx, ecx
mov dword [ebp + 8], eax
jmp 0x10006930
inc esi
and esi, 0xff
movzx eax, byte [ebp + esi - 0x100]
add edi, eax
and edi, 0xff
mov bl, byte [ebp + edi - 0x100]
mov byte [ebp + esi - 0x100], bl
mov byte [ebp + edi - 0x100], al
movzx ebx, byte [ebp + esi - 0x100]
add ebx, eax
and ebx, 0x800000ff
jns 0x10006976
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [ebp + ebx - 0x100]
xor al, byte [edx + ecx]
inc ecx
dec dword [ebp + 8]
mov byte [ecx - 1], al
jne 0x10006930
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10009ea0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, eax
mov ecx, dword [edi + 0x14]
cmp ecx, 0x40
jb 0x10009ec1
push 0x40
or eax, 0xffffffff
mov esi, edi
call fcn.100049a0
jmp 0x10009ecf
mov eax, 0x40
push 0
sub eax, ecx
call fcn.10009340
mov ecx, dword [edi + 0x18]
cmp ecx, 8
jb 0x10009edc
mov eax, dword [edi + 4]
jmp 0x10009edf
lea eax, [edi + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push ecx
push eax
call ebx
mov ecx, dword [edi + 0x14]
cmp eax, dword [edi + 0x18]
ja 0x10009f05
cmp eax, ecx
ja 0x10009f40
push eax
or eax, 0xffffffff
mov esi, edi
call fcn.100049a0
jmp 0x10009f8a
add eax, 0x10
cmp eax, ecx
ja 0x10009f19
push eax
or eax, 0xffffffff
mov esi, edi
call fcn.100049a0
jmp 0x10009f22
push 0
sub eax, ecx
call fcn.10009340
mov ecx, dword [edi + 0x18]
cmp ecx, 8
jb 0x10009f2f
mov eax, dword [edi + 4]
jmp 0x10009f32
lea eax, [edi + 4]
push ecx
push eax
call ebx
cmp eax, dword [edi + 0x18]
ja 0x10009f4b
mov ecx, dword [edi + 0x14]
jmp 0x10009ef1
push 0
sub eax, ecx
call fcn.10009340
jmp 0x10009f8a
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push 4
push 0x14
push 0x100147a8
mov eax, 0x100147a4
call fcn.10006880
add esp, 0x10
mov eax, edi
call fcn.10009e00
push 9
lea ecx, [ebp - 0x14]
push ecx
mov ecx, edi
call fcn.10003fa0
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x10009fb3
cmp dword [edi + 0x18], 8
jb 0x10009f9c
mov eax, dword [edi + 4]
jmp 0x10009f9f
lea eax, [edi + 4]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x10009fb3
push 0x5c
mov eax, 1
call fcn.10009340
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a2f0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x18]
push ebx
push edi
mov edi, dword [eax + 0x30]
mov ecx, dword [edi + 0xa4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 0xa8]
mov dword [esi + 8], edx
movzx eax, word [edi + 0xac]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0xb0]
mov dword [esi + 0x10], ecx
mov eax, dword [edi + 0x1f4]
mov ebx, 1
test eax, eax
je 0x1000a341
push 0x7f
push eax
lea edx, [esi + 0x14]
push edx
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
jmp 0x1000a347
xor eax, eax
mov word [esi + 0x14], ax
movzx ecx, byte [edi + 0xaf]
mov word [esi + 0x114], cx
mov dx, word [edi + 0xae]
mov eax, 0xff
and dx, ax
mov word [esi + 0x116], dx
movzx ecx, word [0x7ffe02d0]
mov word [esi + 0x118], cx
mov byte [esi + 0x11a], 0
cmp byte [0x7ffe0268], 0
je 0x1000a38f
mov ebx, dword [0x7ffe0264]
pop edi
mov byte [esi + 0x11a], bl
cmp ebx, 1
pop ebx
jne 0x1000a3a8
mov edx, 0xffef
and word [esi + 0x118], dx
ret
Function at 0x1000c010
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push esi
push edi
push 0
push 0
push 0x100178e0
mov edi, eax
call ebx
mov esi, eax
test esi, esi
jne 0x1000c135
mov eax, 0x7ffe0030
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000c040
sub eax, edx
sar eax, 1
cmp eax, 2
ja 0x1000c0a6
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 4
push 0x18
push 0x10014874
mov eax, 0x10014870
call fcn.10006880
lea eax, [ebp - 0x18]
add esp, 0x10
lea edx, [eax + 2]
jmp 0x1000c090
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000c090
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x18]
push ecx
jmp 0x1000c0ac
push eax
push 0x7ffe0030
mov esi, edi
call fcn.10004540
cmp dword [edi + 0x18], 8
mov ecx, dword [edi + 0x14]
jb 0x1000c0c1
mov eax, dword [edi + 4]
jmp 0x1000c0c4
lea eax, [edi + 4]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x1000c0d8
push 0x5c
mov eax, 1
call fcn.10009340
mov ebx, dword [edi + 0x14]
lea ebx, [ebx + ebx + 4]
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1000c149
cmp dword [edi + 0x18], 8
mov ecx, dword [edi + 0x14]
jb 0x1000c103
mov eax, dword [edi + 4]
jmp 0x1000c106
lea eax, [edi + 4]
lea edx, [ecx + ecx]
push edx
push eax
push ebx
push esi
call fcn.1000f9d0
mov eax, dword [edi + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
add esp, 0x10
push eax
push 0x100178e8
call edi
push esi
push 0x100178e0
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0x100178e8
call ebx
push eax
push esi
mov esi, edi
call fcn.10004540
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000f772
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x5652487a
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x567d655b
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x401276
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43a008]
jne 0x401280
repz ret
jmp fcn.0040211e

Function at 0x413af8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409a41
and dword [ebp - 4], 0
cmp dword [0x43cd9c], 0
mov ebx, eax
jne 0x413ba9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413c5a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413c5a
push eax
call fcn.004099cf
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43cd9c], eax
call esi
push eax
call fcn.004099cf
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43cda0], eax
call esi
push eax
call fcn.004099cf
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43cda4], eax
call esi
push eax
call fcn.004099cf
pop ecx
mov dword [0x43cdac], eax
test eax, eax
je 0x413ba9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004099cf
pop ecx
mov dword [0x43cda8], eax
mov eax, dword [0x43cda8]
cmp eax, ebx
je 0x413c01
cmp dword [0x43cdac], ebx
je 0x413c01
push eax
call fcn.00409a4a
push dword [0x43cdac]
mov esi, eax
call fcn.00409a4a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413c01
test edi, edi
je 0x413c01
call esi
test eax, eax
je 0x413bf8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413bf8
test byte [ebp - 0xc], 1
jne 0x413c01
or dword [ebp + 0x10], 0x200000
jmp 0x413c3a
mov eax, dword [0x43cda0]
cmp eax, ebx
je 0x413c3a
push eax
call fcn.00409a4a
pop ecx
test eax, eax
je 0x413c3a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413c3a
mov eax, dword [0x43cda4]
cmp eax, ebx
je 0x413c3a
push eax
call fcn.00409a4a
pop ecx
test eax, eax
je 0x413c3a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43cd9c]
call fcn.00409a4a
pop ecx
test eax, eax
je 0x413c5a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413c5c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42cff0
Capabilities:
Get file attributes

Disassembly:
cmp dword [0x43e678], 0x930
jne 0x42d010
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push 0
push 0
call esi
push 0
push 0
call esi
pop esi
cmp dword [0x43e678], 0x114e
mov eax, dword [esp + 4]
mov dword [0x43d37c], eax
jne 0x42d030
push str.dimamehay
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
ret
Function at 0x401023
Capabilities:
Hide graphical window

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [section..data], eax
push 1
push 0
push 0
push dword [section..data]
call 0x401023
push eax
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffffe4
push dword [ebp + 8]
pop dword [0x403038]
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [0x40303c], eax
mov dword [0x403050], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [0x403040], eax
push 0x403024
call sub.user32.dll_RegisterClassExA
push 1
call sub.user32.dll_GetSystemMetrics
shr eax, 1
sub eax, 0xc8
push eax
push 0
call sub.user32.dll_GetSystemMetrics
shr eax, 1
sub eax, 0x12c
pop ebx
push 0
push dword [ebp + 8]
push 0
push 0
push 0x190
push 0x258
push ebx
push eax
push 0
push str.Main_Window
push str.MainWindowClass
push 0
call sub.user32.dll_CreateWindowExA
mov dword [0x403004], eax
push dword [ebp + 0x14]
push eax
call sub.user32.dll_ShowWindow
push dword [0x403004]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_GetMessageA
or eax, eax
je 0x4010e9
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x1c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x4010c2
mov eax, dword [ebp - 0x14]
leave
ret 0x10

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x7d35202a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x770850b3
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x401c2e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
and byte [ebp - 0x100], 0
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
lea eax, [ebp - 0x100]
push 0x404008
push eax
call fcn.00401ca0
mov ecx, 0x401bdc
mov eax, 0x4017fd
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00401d18
push 0x100
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.004020d0
add esp, 0x24
call fcn.00401846
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x21ab940
Capabilities:
Encode data using xor

Disassembly:
jmp 0x21ab94a
pushal
call 0x21ab950
pop ebp
sub ebp, 0x10
sub ebp, 0x1dab940
jmp 0x21ab966
mov eax, 0x1dab940
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d5
mov edx, 0xdd8928a1
xor byte [eax], dl
inc eax
dec ecx
jne 0x21ab97d
jmp 0x21ab990
sub ch, byte [edx + ebp + 0x28]
popfd
mov eax, dword [0x6020a1a1]
pop ecx
mov eax, dword [0x6ca2a1a1]
sbb dword [ecx - 0x76e45e5f], esp
mov eax, dword [0x4356a1a1]
mov byte [0xad202a69], al
mov eax, dword [0x64a2a1a1]
sub al, 0xc5
test dword [ebp + 0x28], ebx
movsd dword es:[edi], dword [esi]
test ecx, esi
leave
movsd dword es:[edi], dword [esi]
invalid
Function at 0x402430
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x8070c8]
jne 0x40243a
repz ret
jmp fcn.00405f1e

Function at 0x405b44
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402eb9
and dword [ebp - 4], 0
cmp dword [0x808a28], 0
mov ebx, eax
jne LoadLibraryW
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405ca6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405ca6
push eax
call fcn.00402e47
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x808a28], eax
call esi
push eax
call fcn.00402e47
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x808a2c], eax
call esi
push eax
call fcn.00402e47
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x808a30], eax
call esi
push eax
call fcn.00402e47
pop ecx
mov dword [0x808a38], eax
test eax, eax
je 0x405bf5
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402e47
pop ecx
mov dword [0x808a34], eax
mov eax, dword [0x808a34]
cmp eax, ebx
je 0x405c4d
cmp dword [0x808a38], ebx
je 0x405c4d
push eax
call fcn.00402ec2
push dword [AssignProcessToJobObject]
mov esi, eax
call fcn.00402ec2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405c4d
test edi, edi
je 0x405c4d
call esi
test eax, eax
je 0x405c44
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405c44
test byte [ebp - 0xc], 1
jne 0x405c4d
or dword [ebp + 0x10], 0x200000
jmp 0x405c86
mov eax, dword [0x808a2c]
cmp eax, ebx
je 0x405c86
push eax
call fcn.00402ec2
pop ecx
test eax, eax
je 0x405c86
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405c86
mov eax, dword [0x808a30]
cmp eax, ebx
je 0x405c86
push eax
call fcn.00402ec2
pop ecx
test eax, eax
je 0x405c86
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x808a28]
call fcn.00402ec2
pop ecx
test eax, eax
je 0x405ca6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405ca8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219