joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fc147
Capabilities:
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax + 0x150]
mov edi, eax
movzx eax, word [ebp + 8]
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp byte [ebp + 0xc], 0
movzx eax, ax
jne 0x4fc18c
test edi, edi
jl 0x4fc18c
cmp ax, 0x20
je 0x4fc181
cmp word [ebp + 8], 0x71
jne 0x4fc18c
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x168]
pop edi
pop esi
pop ebp
ret 8

Function at 0x501481
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x573804]
jne 0x50148b
repz ret
jmp fcn.00508457

Function at 0x513d38
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00507dbb
and dword [ebp - 4], 0
cmp dword [0x57ac20], 0
mov ebx, eax
jne 0x513de9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x513e9a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x513e9a
push eax
call fcn.00507d49
mov dword [esp], 0x551e44
push edi
mov dword [0x57ac20], eax
call esi
push eax
call fcn.00507d49
mov dword [esp], 0x551e30
push edi
mov dword [0x57ac24], eax
call esi
push eax
call fcn.00507d49
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x57ac28], eax
call esi
push eax
call fcn.00507d49
pop ecx
mov dword [0x57ac30], eax
test eax, eax
je 0x513de9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00507d49
pop ecx
mov dword [0x57ac2c], eax
mov eax, dword [0x57ac2c]
cmp eax, ebx
je 0x513e41
cmp dword [0x57ac30], ebx
je 0x513e41
push eax
call fcn.00507dc4
push dword [0x57ac30]
mov esi, eax
call fcn.00507dc4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x513e41
test edi, edi
je 0x513e41
call esi
test eax, eax
je 0x513e38
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x513e38
test byte [ebp - 0xc], 1
jne 0x513e41
or dword [ebp + 0x10], 0x200000
jmp 0x513e7a
mov eax, dword [0x57ac24]
cmp eax, ebx
je 0x513e7a
push eax
call fcn.00507dc4
pop ecx
test eax, eax
je 0x513e7a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x513e7a
mov eax, dword [0x57ac28]
cmp eax, ebx
je 0x513e7a
push eax
call fcn.00507dc4
pop ecx
test eax, eax
je 0x513e7a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x57ac20]
call fcn.00507dc4
pop ecx
test eax, eax
je 0x513e9a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x513e9c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x529159
Capabilities:
Encode data using xor

Disassembly:
lea edx, [ebx - 0xe002c89]
mov ecx, 0x784e0462
not ecx
not cl
jge 0x5291ad
dec edx
and edx, 0xafcfa79d
not edx
add dl, ch
jmp fcn.005cd3c7
and edx, ecx
dec ecx
not ecx
not edx
xor ecx, 0x29
mov dl, 0xea
not dl
xchg dh, dh
sub eax, 2
xchg edx, edx
jmp 0x529109
not ecx
not ecx
sbb edx, esp
not dh
push 0x6ae2
clc
pop eax
xchg cl, ch
nop
mov edx, 0x4c6070f5
not dh
nop
jmp 0x5291ad
add dh, 0xd9
inc edx
and edx, 0x80ab02c6
jmp 0x529132
adc word [eax + 0x5c6c00], 0xc879
dec edx
jmp 0x529183
Function at 0x40a23c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
xor ebp, ebp
xor edi, edi
lea eax, [ebx + 0x10]
call fcn.00403dcc
cmp ebp, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x40a2a5
mov eax, dword [ebx + 0x10]
mov edx, 0x40a3d8
call fcn.00404190
jne 0x40a274
lea eax, [ebx + 0x10]
call fcn.00403dcc
jmp 0x40a2ad
mov eax, dword [ebx + 0x10]
mov edx, 0x40a3e4
call fcn.00404190
jne 0x40a290
lea eax, [ebx + 0x10]
mov edx, 0x40a3d8
call fcn.00403e20
cmp dword [ebx + 0x10], 0
jne 0x40a2ad
lea eax, [ebx + 0x10]
mov edx, 0x40a3e4
call fcn.00403e20
jmp 0x40a2ad
lea eax, [ebx + 0x10]
call fcn.00403dcc
mov eax, ebx
call fcn.0040a08c
mov eax, dword [0x40b158]
inc dword [eax]
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov word [esp], 2
push 0x8b
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a307
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x1bd
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a34a
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x75d7
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a38d
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
test edi, edi
je 0x40a3b7
push esi
call sub.wsock32.dll_closesocket
lea eax, [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
mov edx, 0x40a3f0
call fcn.00404090
mov eax, ebx
call fcn.00409f64
mov ebp, eax
push 0x200
call sub.kernel32.dll_Sleep
jmp 0x40a251

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219

Function at 0x41b790
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10000]
push edi
jmp 0x41b7aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41b7b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41b7a0
mov eax, 1
add ebx, ebx
jne 0x41b7c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41b7b8
jne 0x41b7d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41b7b8
xor ecx, ecx
sub eax, 3
jb 0x41b7e8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41b85a
mov ebp, eax
add ebx, ebx
jne 0x41b7f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41b800
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41b824
inc ecx
add ebx, ebx
jne 0x41b810
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41b805
jne 0x41b821
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41b805
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41b844
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41b835
jmp 0x41b7a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41b844
add edi, ecx
jmp 0x41b7a6
pop esi
mov edi, esi
mov ecx, 0x12d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41b862
cmp byte [edi], 2
jne 0x41b862
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41b867
lea edi, [esi + 0x19000]
mov eax, dword [edi]
or eax, eax
je 0x41b8d6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1b638]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1b6cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41b894
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1b6d4]
or eax, eax
je 0x41b8d0
mov dword [ebx], eax
add ebx, 4
jmp 0x41b8b1
call dword [esi + 0x1b6d0]
mov ebp, dword [esi + 0x1b6d8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41b90a
sub esp, 0xffffff80
jmp 0x405a80
Function at 0x10001960
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10002600
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov ecx, dword [ebp + 0x10]
xor edx, edx
push ebx
push esi
mov eax, dword [ecx + 4]
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], 0
mov dx, word [eax + 0x14]
lea eax, [edx + eax + 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ecx]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dx, word [ecx + 6]
cmp eax, edx
jge 0x10001ae7
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
test ecx, ecx
jne 0x10001a1a
lea ecx, [ebp - 0x24]
push 0x10003108
push ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0x36
call sub.MSVCRT.dll__CxxThrowException
mov edx, dword [ebp + 0xc]
mov esi, dword [edx + 0x38]
test esi, esi
jle 0x10001a14
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
push 4
push 0x1000
mov eax, dword [ebx + 0xc]
push esi
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, 0x10001ac8
ret
lea eax, [ebp - 0x28]
push 0x10003108
push eax
mov dword [ebp - 4], 2
mov dword [ebp - 0x28], 0x43
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [ebp - 0x14]
push 4
push 0x1000
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [ebp - 0x1c]
add edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x20], eax
mov eax, 0x10001a5c
ret
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001b00
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10002610
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [ebp + 8]
xor ecx, ecx
push ebx
push esi
mov eax, dword [eax]
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0
mov cx, word [eax + 0x14]
lea edi, [ecx + eax + 0x18]
mov dword [ebp - 0x14], edi
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [edx]
mov cx, word [eax + 6]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
jge 0x10001c81
mov eax, dword [edi + 0x24]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x10001ba7
lea edx, [ebp - 0x24]
push 0x10003108
push edx
mov dword [ebp - 4], 0
mov dword [ebp - 0x24], 0x4b
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [ebp - 0x14]
push 0x4000
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 0x10001c65
ret
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [esi + ecx*2]
mov ecx, dword [edx*4 + 0x10120014]
mov dword [ebp - 0x1c], ecx
je 0x10001bc6
mov eax, ecx
or ah, 2
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0x10]
test eax, eax
mov dword [ebp - 0x18], eax
jne 0x10001c28
lea edx, [ebp - 0x28]
push 0x10003108
push edx
mov dword [ebp - 4], 2
mov dword [ebp - 0x28], 0x10
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
test al, 0x40
je 0x10001c07
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
mov dword [ebp - 0x18], eax
mov eax, 0x10001c1c
ret
test al, 0x80
je 0x10001c16
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
mov dword [ebp - 0x18], eax
mov eax, 0x10001c1c
ret
jbe 0x10001c6c
lea ecx, [ebp - 0x2c]
push 0x10003108
push ecx
mov dword [ebp - 4], 4
mov dword [ebp - 0x2c], 0xf
call sub.MSVCRT.dll__CxxThrowException
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x10001c65
ret
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x14]
inc ecx
add edi, 0x28
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], edi
jmp 0x10001b3a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002390
Capabilities:
Copy file

Disassembly:
push 0
push 0x101208b0
push 0x1012089c
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [esp + 8]
cmp eax, 1
jne 0x100023e5
mov eax, dword [esp + 4]
push eax
push 0x101208f8
call sub.MFC42.DLL_AfxInitExtensionModule
test eax, eax
jne 0x100023c1
ret 0xc
push 0x40
call sub.MFC42.DLL_operatornew
add esp, 4
test eax, eax
je 0x100023f4
push 0
push 0x101208f8
mov ecx, eax
call sub.MFC42.DLL_CDynLinkLibrary::CDynLinkLibrary
mov eax, 1
ret 0xc
test eax, eax
jne 0x100023f4
push eax
push 0x101208f8
call sub.MFC42.DLL_AfxTermExtensionModule
mov eax, 1
ret 0xc
Function at 0x43534b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0042708b
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x435383
xor eax, eax
jmp 0x4353af
cmp esi, dword [ebp - 4]
je 0x4353ac
cmp dword [ebp + 0xc], 0
je 0x4353ac
push dword [edi + 0x9c]
call fcn.00434f59
push dword [edi + 0x9c]
mov esi, eax
call fcn.00424fcd
pop ecx
pop ecx
cmp esi, eax
je 0x43537f
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219

Function at 0x40153b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esp
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [esp + 0x2c], 1
je 0x401554
movzx esi, word [esp + 0x30]
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x4044e0], eax
mov dword [ebp - 0x4c], 0x30
call fcn.0040152b
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x44], 0x40120e
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.Trick
mov dword [ebp - 0x20], eax
call fcn.0040151e
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test eax, eax
je 0x401626
mov eax, 0x80000000
push edi
push dword [ebp - 0x38]
push edi
push edi
push eax
push eax
push eax
push eax
push 0x80
push str.Qindom
push str.Trick
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x4044e8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4044e8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x401626
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x40160a
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420b5b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x420b9a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420b9a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420b9a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x420b9a
cmp dword [ecx + 0x74], 0xe
jbe 0x420b9a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433310
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43333d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43333d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x6a651178
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x51025cfe
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x414dd6
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx], ebx
or esi, esi
push edx
pop edi
sub edi, 0x980c3b3
add ecx, 4
sub edi, 0x3a701004
dec edi
sub edx, edi
cmp ecx, eax
jne fcn.00414dd6
mov edi, 0x4e9807ab
dec edx
ret
Function at 0x405500
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x659780]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], 0
mov eax, 8
shl eax, 5
mov ecx, dword [eax + 0x662680]
mov dword [0x59cfcc], ecx
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x38], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [0x59cfec]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [ebp - 0x38], 0
je 0x4055e7
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x30]
jle 0x4055e7
mov ecx, dword [ebp - 0x28]
add ecx, 0xa
cmp ecx, dword [ebp - 0x18]
jl 0x4055e7
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x34]
add edx, 0xa
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
cmp edx, eax
jl 0x4055e7
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x30]
add ecx, 5
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 0x20]
jl 0x4055e7
push 0
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [0x59cfec]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_MoveWindow]
mov dword [ebp - 0x40], 1
cmp dword [ebp - 0x40], 0
jne 0x405636
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jle 0x405636
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x18]
add ecx, 5
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x44]
cmp edx, dword [ebp - 0x20]
jl 0x405636
push 0
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [0x59cfec]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [0x65a594]
push eax
mov ecx, dword [0x59cfec]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x59cfec]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [0x59cfc8], 0
call fcn.00406b40
mov dword [0x65a5a4], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050d210
mov esp, ebp
pop ebp
ret

Function at 0x4057b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
mov eax, dword [0x59cfec]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00479240
push eax
call fcn.004071b0
add esp, 4
pop ebp
ret
Function at 0x427180
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x659780]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x54], 0x7efc
mov dword [ebp - 0x4c], 0
push 0x30
push 0x5a0ff0
push 0x65c9f0
call fcn.0050edd0
add esp, 0xc
push 0x38
push str.80_
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.004272a0
add esp, 0x10
mov dword [ebp - 0x44], 0
jmp 0x4271db
mov edx, dword [ebp - 0x44]
add edx, 1
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 0x10
jge 0x427292
mov eax, dword [ebp - 0x54]
and eax, 1
mov ecx, dword [ebp - 0x4c]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x4c], edx
imul eax, dword [ebp - 0x44], 0x30
add eax, 0x65c6f0
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], 0
jmp 0x427213
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], 0x30
jge 0x427285
mov edx, dword [ebp - 0x48]
movsx eax, byte [edx + 0x5a0f40]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x1c
jl 0x427251
mov ecx, dword [ebp - 0x40]
add ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0x38
jl 0x42724f
mov eax, dword [ebp - 0x40]
sub eax, 0x1c
cdq
mov ecx, 0x1c
idiv ecx
add edx, 0x1c
mov dword [ebp - 0x40], edx
jmp 0x42726e
mov edx, dword [ebp - 0x40]
add edx, dword [ebp - 0x4c]
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x40], 0x1c
jl 0x42726e
mov eax, dword [ebp - 0x40]
cdq
mov ecx, 0x1c
idiv ecx
mov dword [ebp - 0x40], edx
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x40]
mov cl, byte [ebp + eax - 0x3c]
mov byte [edx], cl
mov edx, dword [ebp - 0x50]
add edx, 1
mov dword [ebp - 0x50], edx
jmp 0x42720a
mov eax, dword [ebp - 0x54]
shr eax, 1
mov dword [ebp - 0x54], eax
jmp 0x4271d2
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050d210
mov esp, ebp
pop ebp
ret