joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43dc44
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0x1ba], 0
je 0x43dc72
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x1bc]
call dword [ecx + 0x1b8]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00414670
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00414690
mov eax, dword [0x44d634]
call fcn.0042451c
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebp - 4]
add edx, dword [ecx + 0x2c]
cmp eax, edx
ret 0x1a7d
mov eax, dword [0x44d634]
call fcn.0042451c
mov edx, eax
mov eax, dword [ebp - 4]
sub edx, dword [eax + 0x2c]
mov eax, dword [ebp - 4]
call fcn.00414670
mov eax, dword [0x44d634]
call fcn.00424514
mov edx, dword [ebp - 4]
Function at 0x443954
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403938
mov eax, dword [ebp - 8]
call fcn.00403938
xor eax, eax
push ebp
push 0x443b70
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 4]
call fcn.004438bc
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 4]
call fcn.004036a4
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 8]
call fcn.004438bc
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 8]
call fcn.004036a4
lea edx, [ebp - 0x11c]
mov eax, dword [ebp - 4]
call fcn.00443908
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.00406780
mov eax, dword [ebp - 0x118]
lea edx, [ebp - 0xc]
call fcn.004061d0
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x118]
call fcn.004036a4
lea eax, [ebp - 0x118]
mov edx, 0x443b88
call fcn.0040378c
mov eax, dword [ebp - 0x118]
mov edx, 0x443b94
call fcn.00403a6c
test eax, eax
jne 0x443a8d
lea eax, [ebp - 0x111]
push eax
push 0x443ba8
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 4]
call fcn.00443908
mov eax, dword [ebp - 0x118]
call fcn.00403948
push eax
call sub.shell32.dll_FindExecutableA
mov esi, eax
cmp esi, 0x20
jle 0x443a8b
push dword [ebp - 4]
push 0x443bb4
push dword [ebp - 8]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403844
lea edx, [ebp - 4]
lea eax, [ebp - 0x111]
call fcn.004069ec
jmp 0x443a8d
xor ebx, ebx
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 4]
call fcn.00443908
mov eax, dword [ebp - 0x118]
lea edx, [ebp - 0x10]
call fcn.00406710
lea edx, [ebp - 0x11c]
mov eax, dword [ebp - 4]
call fcn.00443908
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.00406748
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 4]
call fcn.004036a4
test bl, bl
je 0x443b32
cmp dword [ebp - 4], 0
jbe 0x443b32
mov dx, 0xfff5
mov eax, dword [0x44d634]
call fcn.00424708
push 1
mov eax, dword [ebp - 0x10]
call fcn.00403948
push eax
mov eax, dword [ebp - 8]
call fcn.00403948
push eax
mov eax, dword [ebp - 4]
call fcn.00403948
push eax
push 0x443bb8
mov eax, dword [0x44d630]
mov eax, dword [eax + 0x20]
push eax
call sub.shell32.dll_ShellExecuteA
mov esi, eax
cmp esi, 0x20
setg bl
xor edx, edx
mov eax, dword [0x44d634]
call fcn.00424708
test bl, bl
jne 0x443b45
cmp esi, 0x20
jg 0x443b45
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0044330c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443b77
lea eax, [ebp - 0x11c]
mov edx, 2
call fcn.00403630
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403630
ret
Function at 0x443bc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x443dfe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x111]
mov edx, 0x443e14
call fcn.004068fc
lea eax, [ebp - 8]
call fcn.00403610
lea eax, [ebp - 0xc]
call fcn.00403610
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x111]
push eax
push 0x80000000
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x443cf2
mov dword [ebp - 4], 0x101
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x111]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueA
test eax, eax
jne 0x443c56
lea edx, [ebp - 8]
lea eax, [ebp - 0x111]
call fcn.004069ec
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
cmp dword [ebp - 8], 0
jne 0x443c72
lea eax, [ebp - 8]
mov edx, 0x443e14
call fcn.004036a4
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x118]
call fcn.004036a4
lea eax, [ebp - 0x118]
mov edx, 0x443e24
call fcn.0040378c
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 0x111]
call fcn.004068fc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x111]
push eax
push 0x80000000
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x443cf2
mov dword [ebp - 4], 0x101
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x111]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueA
test eax, eax
jne 0x443ce9
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x111]
call fcn.004069ec
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
cmp dword [ebp - 0xc], 0
jbe 0x443db2
mov edx, dword [ebp - 0xc]
mov eax, 0x443e40
call fcn.00403a6c
test eax, eax
jle 0x443d1f
lea ecx, [ebp - 0xc]
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.0042caa0
jmp 0x443d75
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 0xc]
call fcn.004061d0
mov edx, dword [ebp - 0x118]
mov eax, 0x443e4c
call fcn.00403a6c
test eax, eax
jle 0x443d75
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 0xc]
call fcn.004061d0
mov edx, dword [ebp - 0x118]
mov eax, 0x443e4c
call fcn.00403a6c
mov ecx, eax
add ecx, 4
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00403988
mov edx, 0x443e40
lea eax, [ebp - 0x118]
call fcn.004036a4
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.0040378c
lea eax, [ebp - 0x118]
mov edx, 0x443e40
call fcn.0040378c
mov edx, dword [ebp - 0x118]
mov eax, dword [ebp - 0xc]
call fcn.00443954
jmp 0x443dd8
mov eax, dword [0x44d688]
mov ecx, dword [eax + 0x228]
mov eax, dword [0x44d688]
mov edx, dword [eax + 0x268]
mov eax, dword [0x44d688]
mov eax, dword [eax + 0x23c]
call fcn.00446dbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443e05
lea eax, [ebp - 0x118]
call fcn.00403610
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403630
ret
Function at 0x445978
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor ebp, ebp
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.00445600
mov byte [ebx + 0x1da], al
mov edi, dword [ebx + 0x1ac]
jmp 0x445a2e
mov eax, ebx
call fcn.00445600
mov byte [esp + 4], al
cmp byte [esp + 4], 0x80
jb 0x4459e0
xor eax, eax
mov al, byte [esp + 4]
mov esi, 0xff
sub esi, eax
inc esi
test esi, esi
jle 0x445a11
mov eax, ebx
call fcn.00445600
mov byte [ebx + 0x1da], al
mov al, byte [ebx + 0x1da]
mov byte [edi], al
inc ebp
inc edi
dec esi
jne 0x4459c4
jmp 0x445a11
mov eax, ebx
call fcn.00445600
mov byte [ebx + 0x1da], al
xor eax, eax
mov al, byte [esp + 4]
cdq
xor eax, edx
sub eax, edx
mov esi, eax
and esi, 0xff
test esi, esi
jle 0x445a11
mov al, byte [ebx + 0x1da]
mov byte [edi], al
inc ebp
inc edi
dec esi
jne 0x445a04
movzx eax, word [ebx + 0x1e6]
cmp ebp, eax
jl 0x445a2e
xor ebp, ebp
inc dword [esp]
mov eax, ebx
call fcn.00445600
mov byte [ebx + 0x1da], al
movzx eax, word [ebx + 0x1e8]
cmp eax, dword [esp]
jg 0x4459a0
push ebx
push 0x4454b0
mov eax, ebx
call fcn.0040f4c4
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x448404
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4484e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x110]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x110]
lea eax, [ebp - 3]
mov cl, 1
call fcn.00402a30
lea eax, [ebp - 0x118]
lea edx, [ebp - 3]
call fcn.00403730
mov eax, dword [ebp - 0x118]
lea edx, [ebp - 0x114]
call fcn.004061d0
mov eax, dword [ebp - 0x114]
mov bl, byte [eax]
mov eax, ebx
add al, 0xbf
sub al, 0x1a
jae 0x4484be
lea eax, [ebp - 0x114]
mov edx, ebx
call fcn.00403720
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 8]
mov ecx, 0x448500
call fcn.004037d0
lea eax, [ebp - 0x109]
mov edx, dword [ebp - 8]
call fcn.004068fc
mov ebx, eax
push ebx
call sub.kernel32.dll_GetDriveTypeA
test eax, eax
setg byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4484eb
lea eax, [ebp - 0x118]
mov edx, 2
call fcn.00403630
lea eax, [ebp - 8]
call fcn.00403610
ret
Function at 0x4493d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403938
xor eax, eax
push ebp
push 0x44947a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x109]
mov edx, dword [ebp - 4]
call fcn.004068fc
lea eax, [ebp - 0x109]
call fcn.0040680c
mov esi, eax
call sub.kernel32.dll_GetEnvironmentStringsA
mov ebx, eax
jmp 0x449451
movzx edi, si
mov ecx, edi
lea edx, [ebp - 0x109]
mov eax, ebx
call fcn.00406960
test eax, eax
jne 0x449447
cmp byte [ebx + edi], 0x3d
jne 0x449447
mov edx, dword [ebp - 8]
mov eax, edi
add eax, ebx
inc eax
call fcn.004069ec
jmp 0x449464
mov eax, ebx
call fcn.0040680c
inc eax
add ebx, eax
cmp byte [ebx], 0
jne 0x44941c
push ebx
call sub.kernel32.dll_FreeEnvironmentStringsA
mov eax, dword [ebp - 8]
call fcn.00403610
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449481
lea eax, [ebp - 4]
call fcn.00403610
ret

Function at 0x449878
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
call fcn.004034d0
call fcn.00404ffc
call fcn.00408dc4
call fcn.00408f60
call fcn.0040fc6c
call fcn.00410a5c
call fcn.004129f0
call fcn.0041907c
call fcn.004262c4
call fcn.0042c3b0
call fcn.0043cc88
call fcn.0044983c
cmp byte [0x44a1c8], 5
jne 0x4498cd
call fcn.0043aa80
jmp 0x44994e
cmp byte [0x44a1c8], 4
jne 0x4498e6
cmp dword [0x44a1cc], 0
je 0x44994e
call fcn.0043ad70
jmp 0x44994e
mov eax, dword [0x44d630]
call fcn.0042591c
mov edx, 0x449960
mov eax, dword [0x44d630]
call fcn.00425638
mov ecx, 0x44d688
mov edx, 0x43184c
mov eax, dword [0x44d630]
call fcn.0042592c
mov ecx, 0x44d6a8
mov edx, 0x442688
mov eax, dword [0x44d630]
call fcn.0042592c
mov eax, dword [0x44d630]
call fcn.004259bc
cmp byte [0x44a1c8], 0
jbe 0x44994e
cmp dword [0x44a1d0], 0
je 0x44994e
mov eax, dword [0x44a1d0]
push eax
call sub.user32.dll_SetForegroundWindow
call fcn.00404854
mov esp, ebp
pop ebp
ret
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x2a
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x98
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xf0
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x89
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x34
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0x29
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x1e
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x79
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x8b
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xf1
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xc0
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xe8
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x4e
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xbc
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x4015e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x4015e1
lcall 0x5de5, 0x8b10c483
jmp loc.00b64b34
Function at 0x402e00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40d029], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.Marmimo
push str.Mimoclass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402e48
xor eax, eax
jmp 0x402e63
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x405413
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404305
and dword [ebp - 4], 0
cmp dword [0x40ea48], 0
mov ebx, eax
jne 0x4054c4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405575
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405575
push eax
call fcn.00404293
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40ea48], eax
call esi
push eax
call fcn.00404293
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40ea4c], eax
call esi
push eax
call fcn.00404293
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40ea50], eax
call esi
push eax
call fcn.00404293
pop ecx
mov dword [0x40ea58], eax
test eax, eax
je 0x4054c4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404293
pop ecx
mov dword [0x40ea54], eax
mov eax, dword [0x40ea54]
cmp eax, ebx
je 0x40551c
cmp dword [0x40ea58], ebx
je 0x40551c
push eax
call fcn.0040430e
push dword [0x40ea58]
mov esi, eax
call fcn.0040430e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40551c
test edi, edi
je 0x40551c
call esi
test eax, eax
je 0x405513
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405513
test byte [ebp - 0xc], 1
jne 0x40551c
or dword [ebp + 0x10], 0x200000
jmp 0x405555
mov eax, dword [0x40ea4c]
cmp eax, ebx
je 0x405555
push eax
call fcn.0040430e
pop ecx
test eax, eax
je 0x405555
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405555
mov eax, dword [0x40ea50]
cmp eax, ebx
je 0x405555
push eax
call fcn.0040430e
pop ecx
test eax, eax
je 0x405555
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40ea48]
call fcn.0040430e
pop ecx
test eax, eax
je 0x405575
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405577
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40727e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40dac8]
jne 0x407288
repz ret
jmp fcn.004089a5

Function at 0x414def
Capabilities:
Encode data using xor

Disassembly:
xor dword [edi], edx
add edi, 4
cmp edi, eax
jne fcn.00414def
and ebx, esi
and ebx, ecx
ret
Function at 0x401415
Capabilities:
Encode data using xor

Disassembly:
jmp 0x413cd0
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x413e57
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
nop dword [eax]
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x7e
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xbb
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x1e
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x1b
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xd5
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x6a
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x9a
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xa7
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xe
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0xc1
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xa2
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x39
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xfe
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x19
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0xd8
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x49
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x9f
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xfd
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x49
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x1f
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x3c
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x58
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xb1
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xb3
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x79
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x5d
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0xd3
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xb1
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x98
inc edi
cmp edi, ebx
jb 0x413cf0
pop esi
pop ebp
pop edi
pop ebx
ret

Function at 0x4038a0
Capabilities:
Terminate process

Disassembly:
jmp 0x452c69
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x452c7a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405e2f
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x4039d6
Capabilities:
Query environment variable

Disassembly:
jmp 0x4a83f2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4a8403
pop esi
ret
push ebx
push edi
push esi
call fcn.004a82d9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00404318
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4a842b
push ebx
push esi
push edi
call fcn.00405bff
add esp, 0xc
push 0
call fcn.00406839
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x40a03e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40a04d
pop dword [ebp - 0x38]
mov eax, 0x33687412
add eax, 0xccd82c3b
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x54b42
push 0
mov eax, 0x75ca69e
sub eax, 0x717f3e2
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x770f6960
sub ecx, 0x770f0e53
xor edx, edx
add edx, eax
mov esi, 0xe603f2fd
sub esi, 0xe5bb74fd
add esi, dword [ebp - 0x38]
mov ebx, 0xd95500ba
add ebx, 0xdfa1c89a
xor dword [ebp - 0x2c], 0xeac1a97
mov edi, dword [esi]
add dword [ebp - 0x28], 0x25bd502
xor edi, ebx
add dword [ebp - 0x2c], edi
mov dword [edx], edi
add dword [ebp - 0x14], ebx
add edx, 0x2efd5e70
sub edx, 0x2efd5e6c
add esi, 0x320d556d
add esi, 0xcdf2aa97
loop 0x40a0ae
add eax, 0x15f07
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x408919
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
dec ebx
add ebx, ebx
call fcn.0040894f
and edi, ebx
xor dword [esi], ecx
add esi, 1
cmp esi, eax
jne fcn.00408919
or edi, ebx
sub esp, 4
mov dword [esp], 0x83eca8ff
mov edi, dword [esp]
add esp, 4
ret
Function at 0x43b647
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop edx
mov ecx, ecx
sub ecx, 0x983b9e3b
push 0xd006eaa0
pop ecx
call fcn.0043b690
add eax, 0x175a3d64
mov ecx, 0xcea69a11
xor dword [edi], edx
or ecx, eax
dec ecx
or ecx, ecx
add edi, 1
add ecx, eax
cmp edi, esi
jne fcn.0043b647
dec ecx
add ecx, eax
ret