joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10025180
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x5c]
mov edx, dword [eax + 4]
mov eax, dword [edx + esi + 0x60]
cmp dword [eax + 0x4c], 0xffffffff
lea ecx, [esi + 0x5c]
je 0x1002519c
call dword [sym.imp.MSVCIRT.dll_public:_void___thiscall_ofstream::close_void_]
mov eax, dword [esp + 8]
test eax, eax
je 0x100251b4
mov ecx, dword [esi + 0x4b9]
push ecx
call dword [sym.imp.MSVCRT.dll_remove]
add esp, 4
mov byte [esi + 0x4e5], 1
pop esi
ret 4

Function at 0x100252f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10029843
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
lea eax, [esi + 4]
lea ecx, [esi + 0xc]
mov dword [esp + 8], esi
mov dword [eax], edi
mov dword [esi + 8], ecx
mov dword [ecx], eax
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], 0x7fffffff
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi], vtable.R_DLList_class_R_CPUDriver__.0
lea eax, [esi + 0x2c]
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], edi
mov dword [eax], edi
mov dword [esi + 0x30], ecx
mov dword [ecx], eax
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], 0x7fffffff
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x28], vtable.R_DLList_struct_HINSTANCE____.0
push 1
lea ecx, [esi + 0x5c]
mov byte [esp + 0x18], 1
call dword [sym.imp.MSVCIRT.dll_public:_void___thiscall_ofstream::constructor_void_]
lea eax, [esi + 0x4c1]
lea ecx, [esi + 0x4c9]
mov dword [eax], edi
mov dword [esi + 0x4c5], ecx
mov dword [ecx], eax
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x4cd], edi
mov dword [esi + 0x4d1], edi
mov dword [esi + 0x4d9], edi
mov dword [esi + 0x4dd], edi
mov dword [esi + 0x4e1], edi
mov dword [esi + 0x4d5], 0x7fffffff
mov dword [esi + 0x4bd], 0x1002afec
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x10026a90
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
lea eax, [esp]
push eax
mov dword [esp + 4], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 8]
add esp, 0x20
ret

Function at 0x10026ab0
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
lea eax, [esp]
push eax
mov dword [esp + 4], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x10026c50
Capabilities:
Enumerate files on windows
Get common file path
Query environment variable
Set current directory

Disassembly:
sub esp, 0x468
push ebx
push esi
mov ebx, ecx
mov eax, dword [ebx]
push edi
call dword [eax + 4]
mov edx, dword [ebx + 0xc]
lea ecx, [ebx + 0xc]
mov esi, eax
lea eax, [esi - 8]
mov dword [edx + 4], eax
mov dword [eax + 4], ecx
mov dword [eax], edx
mov dword [ecx], eax
mov ecx, dword [ebx + 0x14]
inc ecx
mov dword [ebx + 0x18], 0x7fffffff
mov dword [ebx + 0x14], ecx
call fcn.100272e0
mov dword [ebx + 0x54], eax
mov dword [esi], eax
mov ecx, dword [ebx + 0x54]
push ecx
mov ecx, ebx
call sym.rlmfc.dll_public:_void___thiscall_R_System::setActiveCPUDriver_class_R_CPUDriver__
or ecx, 0xffffffff
xor eax, eax
mov edi, str._mfcrel.dll
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edx, [esp + 0x374]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
xor eax, eax
mov edi, str.rldriver
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
lea edx, [esp + 0x34]
mov esi, edi
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.MSVCRT.dll__stat]
add esp, 8
cmp eax, 0xffffffff
je 0x10026d08
mov eax, dword [esp + 0x16]
test ah, 0x40
jne 0x10026d1d
push 0x100
lea eax, [esp + 0x38]
push eax
push str.RLDRIVERPATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [esp + 0x274]
push ecx
push 0xff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x378]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0xc], esi
je 0x10026dbe
push ebp
lea edx, [esp + 0x164]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
test ebp, ebp
je 0x10026da3
mov eax, dword [ebx + 0x28]
lea esi, [ebx + 0x28]
mov ecx, esi
call dword [eax + 4]
mov edi, dword [esi + 0xc]
lea edx, [esi + 0xc]
lea ecx, [eax - 8]
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [ecx + 4], edx
mov dword [edx], ecx
mov ecx, dword [esi + 0x14]
inc ecx
mov dword [esi + 0x18], 0x7fffffff
mov dword [esi + 0x14], ecx
mov esi, dword [esp + 0x10]
mov dword [eax], ebp
lea ecx, [esp + 0x138]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10026d5d
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
lea edx, [esp + 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
pop edi
pop esi
pop ebx
add esp, 0x468
ret
Function at 0x40106a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ebx
push esi
mov esi, dword [eax + 4]
mov eax, dword [0x42d3f8]
mov dword [ebp - 0x30], eax
mov eax, dword [0x42d3fc]
push edi
xor edi, edi
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], edi
call fcn.00401063
mov eax, dword [0x42d400]
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [str._N]
add ebx, 0x23f
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, dword [ebp - 0xc]
shl eax, 4
cmp dword [0x1a1dfac], 0xc
mov dword [ebp - 4], eax
jne 0x4010ef
push edi
lea eax, [ebp - 0x34]
push eax
push edi
lea eax, [ebp - 0x434]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x1a1dfac]
cmp eax, 0xfa9
jne 0x40110b
mov dword [0x1a1dfa8], 0xedeb2e40
cmp eax, 0x3eb
jne 0x40111f
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [0x1a1defc], edi
mov eax, dword [ebp - 0xc]
add eax, ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [0x1a1dfa4], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 8], eax
sub esi, dword [ebp - 8]
cmp dword [0x1a1dfac], 0xc
mov dword [ebp - 4], eax
jne 0x401175
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
lea eax, [ebx + esi]
mov dword [ebp - 0x18], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0xc], eax
add ebx, 0x61c88647
dec dword [ebp - 0x20]
jne 0x4010be
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax + 4], esi
pop esi
mov dword [eax], ecx
pop ebx
leave
ret 4
Function at 0x40448c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c250]
jne 0x404496
repz ret
jmp fcn.00409bc4

Function at 0x40b1aa
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406f5c
and dword [ebp - 4], 0
cmp dword [0x4367a4], 0
mov ebx, eax
jne 0x40b25b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b30c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b30c
push eax
call fcn.00406eea
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4367a4], eax
call esi
push eax
call fcn.00406eea
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4367a8], eax
call esi
push eax
call fcn.00406eea
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4367ac], eax
call esi
push eax
call fcn.00406eea
pop ecx
mov dword [0x4367b4], eax
test eax, eax
je 0x40b25b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406eea
pop ecx
mov dword [0x4367b0], eax
mov eax, dword [0x4367b0]
cmp eax, ebx
je 0x40b2b3
cmp dword [0x4367b4], ebx
je 0x40b2b3
push eax
call fcn.00406f65
push dword [0x4367b4]
mov esi, eax
call fcn.00406f65
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b2b3
test edi, edi
je 0x40b2b3
call esi
test eax, eax
je 0x40b2aa
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b2aa
test byte [ebp - 0xc], 1
jne 0x40b2b3
or dword [ebp + 0x10], 0x200000
jmp 0x40b2ec
mov eax, dword [0x4367a8]
cmp eax, ebx
je 0x40b2ec
push eax
call fcn.00406f65
pop ecx
test eax, eax
je 0x40b2ec
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b2ec
mov eax, dword [0x4367ac]
cmp eax, ebx
je 0x40b2ec
push eax
call fcn.00406f65
pop ecx
test eax, eax
je 0x40b2ec
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4367a4]
call fcn.00406f65
pop ecx
test eax, eax
je 0x40b30c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b30e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401b4b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x401b5a
pop dword [ebp - 0x28]
mov eax, 0x401b5a
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x4ce7c649
add dword [ebp - 0x38], 0x16a7f02
mov dword [ebp - 0x34], 0xad9047bb
sub dword [ebp - 0x34], 0x7b5cfb76
mov dword [ebp - 0x30], 0x1919686a
add dword [ebp - 0x30], 0x3332dbc4
mov dword [ebp - 0x2c], 0x3ad1e69c
add dword [ebp - 0x2c], 0xc52e1964
lea eax, [ebp - 0x38]
push eax
mov eax, 0x7a2a51e3
sub eax, 0x79e9818f
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xe4a667e1
add dword [ebp - 0x38], 0x8fcc0175
mov dword [ebp - 0x34], 0x5837122c
sub dword [ebp - 0x34], 0x16cab0b7
mov dword [ebp - 0x30], 0x4056c1c8
sub dword [ebp - 0x30], 0xdce7555c
mov dword [ebp - 0x2c], 0xbc6bd770
sub dword [ebp - 0x2c], 0xbc6bd770
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xff4bf6a3
add eax, 0xf4d9a9
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x38c0d
push 0
call eax
mov ecx, 0x4435
xor edi, edi
add edi, eax
mov esi, 0x41b000
add esi, dword [ebp - 0x28]
mov ebx, 0x2ca7ef6b
add ebx, 0xfa79257
xor dword [ebp - 0x18], 0x2654ce5b
mov edx, dword [esi]
add dword [ebp - 0x10], ebx
xor edx, ebx
add dword [ebp - 0xc], 0x5d253aa2
mov dword [edi], edx
add dword [ebp - 0x18], esi
add edi, 0x7737f1c1
sub edi, 0x7737f1bd
add esi, 0xc406e7b9
add esi, 0x3bf9184b
loop 0x401c6d
add eax, 0x103a7
mov ebx, eax
add eax, 0xbc63c3ef
add eax, 0x439c3c16
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x40b6d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
xor edi, edi
push esi
push ebx
push edx
mov ebp, dword [esp + 0x18]
lea esi, [ebp + 2]
movzx eax, byte [ebp]
mov byte [esp + 3], al
movzx edx, byte [ebp + 1]
mov byte [esp + 2], dl
cmp edi, dword [esp + 0x20]
jge 0x40b728
inc byte [esp + 3]
movzx ecx, byte [esp + 3]
movzx edx, byte [esi + ecx]
add byte [esp + 2], dl
movzx ebx, byte [esp + 2]
movzx eax, byte [esi + ebx]
mov byte [esi + ecx], al
mov byte [esi + ebx], dl
add dl, byte [esi + ecx]
movzx eax, dl
mov edx, dword [esp + 0x1c]
movzx eax, byte [esi + eax]
xor byte [edx + edi], al
inc edi
jmp 0x40b6ee
movzx eax, byte [esp + 3]
mov byte [ebp], al
movzx edx, byte [esp + 2]
mov byte [ebp + 1], dl
pop eax
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40e544
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x50], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x54], 0
ret

Function at 0x40ef6f
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x460
mov ebp, dword [esp + 0x478]
push 0x43d700
push dword [esp + 0x478]
call sub.msvcrt.dll_fopen
mov edi, eax
test edi, edi
pop eax
pop edx
jne 0x40ef9f
mov byte [ebp], 0
jmp 0x40efff
lea eax, [esp + 0x400]
push eax
call fcn.0040e544
push 0
push 0
push edi
call sub.msvcrt.dll_fseek
add esp, 0x10
jmp 0x40efc6
push eax
push ebx
push esi
call fcn.0040e579
add esp, 0xc
push edi
push 0x400
push 1
lea ebx, [esp + 0xc]
push ebx
call sub.msvcrt.dll_fread
add esp, 0x10
test eax, eax
lea esi, [esp + 0x400]
jne 0x40efbb
push 0
push ebx
push esi
call fcn.0040e579
push edi
call sub.msvcrt.dll_fclose
push esi
push ebp
call fcn.0040ee72
add esp, 0x18
add esp, 0x460
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40f33e
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x444610], 0
push edi
push esi
push ebx
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
je 0x40f40e
mov edx, dword [0x444b20]
mov eax, 0x40
sub eax, edx
cmp esi, eax
jl 0x40f3f3
mov eax, 0x40
xor ebx, ebx
sub eax, edx
push eax
add edx, 0x444ae0
push edi
push edx
call sub.msvcrt.dll_memcpy
push 0x444ae0
mov edx, dword [0x444b20]
mov eax, edi
push 0x444acc
sub eax, edx
lea esi, [esi + edx - 0x40]
lea edi, [eax + 0x40]
call fcn.00413244
mov ecx, dword [0x444ac8]
add esp, 0x14
movzx edx, byte [ebx + 0x444ae0]
mov eax, ecx
inc ecx
xor byte [eax + 0x444618], dl
cmp ecx, 0x4b0
mov eax, 0
cmovge ecx, eax
inc ebx
cmp ebx, 0x13
jle 0x40f3ab
mov dword [0x444ac8], ecx
cmp ecx, 0x13
jg 0x40f3df
call fcn.0040f21c
mov dword [0x444b20], 0
xor edx, edx
cmp esi, 0x40
jmp 0x40f365
push esi
mov eax, dword [0x444b20]
push edi
add eax, 0x444ae0
push eax
call sub.msvcrt.dll_memcpy
add dword [0x444b20], esi
add esp, 0xc
pop ebx
pop esi
pop edi
ret
Function at 0x40f53a
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
push 1
push 0x258
call fcn.00401771
mov ebx, eax
call fcn.0040f21c
push 0x258
mov eax, dword [0x444ac8]
add eax, 0x444618
push eax
push ebx
call sub.msvcrt.dll_memcpy
mov dword [esi], 0x258
add esp, 0x14
mov dword [edi], ebx
pop ebx
pop esi
pop edi
jmp fcn.0040f21c

Function at 0x413244
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x15c
xor ebx, ebx
mov edx, dword [esp + 0x174]
mov eax, dword [edx + ebx*4]
mov dword [esp + ebx*4 + 0x1c], eax
inc ebx
cmp ebx, 0xf
jle 0x413257
mov ebx, 0x10
mov eax, dword [esp + ebx*4 - 4]
xor eax, dword [esp + ebx*4 + 0x10]
xor eax, dword [esp + ebx*4 - 0x1c]
xor eax, dword [esp + ebx*4 - 0x24]
rol eax, 1
mov dword [esp + ebx*4 + 0x1c], eax
inc ebx
cmp ebx, 0x4f
jle 0x413269
mov eax, dword [esp + 0x170]
xor ebx, ebx
mov edx, dword [esp + 0x170]
mov eax, dword [eax]
mov esi, dword [edx + 4]
mov edi, dword [edx + 8]
mov dword [esp + 0x10], eax
mov ebp, dword [edx + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [edx + 0x10]
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov dword [esp + 0x14], eax
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov edx, esi
mov ecx, esi
not edx
and ecx, edi
and edx, ebp
rol eax, 5
or ecx, edx
add eax, ecx
add eax, dword [esp + 0x14]
mov dword [esp + 0x14], ebp
mov ebp, edi
mov edi, esi
add eax, dword [esp + ebx*4 + 0x1c]
inc ebx
rol edi, 0x1e
mov esi, dword [esp + 0x18]
add eax, 0x5a827999
cmp ebx, 0x13
mov dword [esp + 0x18], eax
jle 0x4132be
mov ebx, 0x14
mov edx, dword [esp + 0x18]
mov eax, esi
xor eax, edi
xor eax, ebp
rol edx, 5
add edx, eax
add edx, dword [esp + 0x14]
mov dword [esp + 0x14], ebp
mov ebp, edi
mov edi, esi
add edx, dword [esp + ebx*4 + 0x1c]
inc ebx
rol edi, 0x1e
mov esi, dword [esp + 0x18]
add edx, 0x6ed9eba1
cmp ebx, 0x27
mov dword [esp + 0x18], edx
jle 0x4132fe
mov ebx, 0x28
mov eax, dword [esp + 0x18]
mov edx, edi
mov ecx, edi
or edx, ebp
and ecx, ebp
and edx, esi
rol eax, 5
or edx, ecx
add eax, edx
add eax, dword [esp + 0x14]
mov dword [esp + 0x14], ebp
mov ebp, edi
mov edi, esi
add eax, dword [esp + ebx*4 + 0x1c]
inc ebx
rol edi, 0x1e
mov esi, dword [esp + 0x18]
sub eax, 0x70e44324
cmp ebx, 0x3b
mov dword [esp + 0x18], eax
jle 0x413339
mov ebx, 0x3c
mov eax, dword [esp + 0x18]
mov edx, esi
xor edx, edi
xor edx, ebp
rol eax, 5
add eax, edx
add eax, dword [esp + 0x14]
mov dword [esp + 0x14], ebp
mov ebp, edi
mov edi, esi
add eax, dword [esp + ebx*4 + 0x1c]
inc ebx
rol edi, 0x1e
mov esi, dword [esp + 0x18]
sub eax, 0x359d3e2a
cmp ebx, 0x4f
mov dword [esp + 0x18], eax
jle 0x413379
add eax, dword [esp + 0x10]
mov edx, dword [esp + 0x170]
mov dword [edx], eax
mov eax, dword [esp + 0xc]
add eax, esi
mov dword [edx + 4], eax
mov eax, dword [esp + 8]
add eax, edi
mov dword [edx + 8], eax
mov eax, dword [esp + 4]
add eax, ebp
mov dword [edx + 0xc], eax
mov eax, dword [esp]
add eax, dword [esp + 0x14]
mov dword [edx + 0x10], eax
add esp, 0x15c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x401c2f
pop dword [ebp - 0x24]
mov eax, 0x8b6dd22d
add eax, 0x74d24a02
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x57d9358c
sub dword [ebp - 0x34], 0x986f041
mov dword [ebp - 0x30], 0x875b4050
sub dword [ebp - 0x30], 0x5527f40b
mov dword [ebp - 0x2c], 0x11e13ab8
add dword [ebp - 0x2c], 0x3a6b0976
mov dword [ebp - 0x28], 0x105aa209
sub dword [ebp - 0x28], 0x105aa209
lea eax, [ebp - 0x34]
push eax
mov eax, 0x153b2f6e
sub eax, 0x14f78ebe
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x78bb9774
sub dword [ebp - 0x34], 0x4492e1e
mov dword [ebp - 0x30], 0x798d9619
add dword [ebp - 0x30], 0xc7decb5c
mov dword [ebp - 0x2c], 0x5b647c82
add dword [ebp - 0x2c], 0x80aefea
mov dword [ebp - 0x28], 0x25823726
add dword [ebp - 0x28], 0xda7dc8da
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xa4f8bfa5
add eax, 0x5b4ae093
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3eeff
push 0
call eax
mov ecx, 0x4a68
xor esi, esi
add esi, eax
mov edx, 0xbd9760a3
add edx, 0x42ae195d
add edx, dword [ebp - 0x24]
mov ebx, 0xf17e28b1
sub ebx, 0xec7c237b
mov edi, dword [edx]
xor dword [ebp - 0x14], 0x398bba02
add edi, ebx
sub dword [ebp - 0xc], 0x28632ef1
mov dword [esi], edi
sub dword [ebp - 0x18], 0xedf2e569
add esi, 4
add edx, 4
loop 0x401d4d
add eax, 0x11c73
xor ebx, ebx
add ebx, eax
add eax, 0x60ab9749
sub eax, 0x60ab9744
mov ecx, 0xbf29203a
add ecx, 0x4116dfc6
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x41fb6c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00416e52
and dword [ebp - 0x14], 0
cmp dword [0x4599f8], 0
mov dword [ebp - 0x18], eax
jne 0x41fc1f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41fcc7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41fcc7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4599f8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4599fc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x459a00], eax
call edi
push eax
call esi
mov dword [0x459a08], eax
test eax, eax
je 0x41fc1f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x459a04], eax
mov eax, dword [0x459a04]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41fc78
cmp dword [0x459a08], ecx
je 0x41fc78
push eax
call esi
push dword [0x459a08]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41fc78
test ebx, ebx
je 0x41fc78
call edi
test eax, eax
je 0x41fc6f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41fc6f
test byte [ebp - 8], 1
jne 0x41fc78
or dword [ebp + 0x10], 0x200000
jmp 0x41fcab
mov eax, dword [0x4599fc]
cmp eax, dword [ebp - 0x18]
je 0x41fcab
push eax
call esi
test eax, eax
je 0x41fcab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41fcab
mov eax, dword [0x459a00]
cmp eax, dword [ebp - 0x18]
je 0x41fcab
push eax
call esi
test eax, eax
je 0x41fcab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4599f8]
call esi
test eax, eax
je 0x41fcc7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41fcc9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004113cb
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x6e045ecb
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x2ef65fb7
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219