joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412754
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
push edi
sub esp, 0xc
mov esi, esp
push 0x43559e
call fcn.0041039f
sub esp, 0xc
lea eax, [ebp + 8]
mov esi, esp
call fcn.004103d1
call fcn.00405229
add esp, 0x18
cmp dword [ebp + 0x14], 0
mov esi, eax
mov dword [ebp - 4], edx
je 0x4128bd
push 0x43559f
lea esi, [ebp - 0xc]
call fcn.0041039f
push str..exe
push 6
pop ebx
lea edi, [ebp - 0x18]
call fcn.00411b02
push 0x4356d4
push dword [0x63f7b0]
mov edi, eax
lea esi, [ebp - 0x24]
lea eax, [ebp - 0xc]
call fcn.004104c1
lea esi, [ebp - 0x30]
call fcn.004104c1
lea esi, [ebp - 0x48]
call fcn.0041047f
lea esi, [ebp - 0x3c]
call fcn.004104c1
lea esi, [ebp - 0xc]
call fcn.00410445
mov eax, dword [ebp - 0x3c]
call fcn.00402910
mov eax, dword [ebp - 0x48]
call fcn.00402910
mov eax, dword [ebp - 0x30]
call fcn.00402910
mov eax, dword [ebp - 0x24]
call fcn.00402910
mov eax, dword [ebp - 0x18]
call fcn.00402910
push 0x1a00
push 0x43ccd8
sub esp, 0xc
mov eax, esi
mov esi, esp
call fcn.004103d1
call fcn.00412300
xor eax, eax
lea edi, [ebp - 0x58]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x14
push 0x44
stosd dword es:[edi], eax
xor ebx, ebx
lea eax, [ebp - 0xa0]
push ebx
push eax
call fcn.00423750
add esp, 0xc
push 0x4356e0
lea esi, [ebp - 0x24]
lea eax, [ebp - 0xc]
call fcn.004104c1
lea edi, [ebp + 8]
lea esi, [ebp - 0x18]
call fcn.0041047f
lea esi, [ebp - 0xc]
call fcn.00410445
mov eax, dword [ebp - 0x18]
call fcn.00402910
mov eax, dword [ebp - 0x24]
call fcn.00402910
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xa0]
push eax
push ebx
push ebx
push 0x20
push 1
push ebx
push ebx
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [ebp - 0xc]
call fcn.00402910
xor edi, edi
inc edi
lea esi, [ebp + 0x18]
call fcn.00401cce
mov eax, dword [ebp + 8]
call fcn.00402910
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
xor edi, edi
push esi
call fcn.0040f402
pop ecx
test eax, eax
jne 0x4128a3
inc edi
cmp edi, 0x64
jl 0x4128bf
xor edi, edi
jmp 0x4128a6
Function at 0x414ca6
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
mov eax, dword [0x43c078]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x435a00
push dword [ebp + 0x80]
mov dword [ebp - 0x474], eax
mov dword [ebp - 0x460], ebx
mov dword [ebp - 0x470], ebx
call dword [0x63faf0]
xor esi, esi
inc esi
test eax, eax
je 0x414cf2
mov dword [ebp - 0x460], esi
push ebx
push 0x435a10
push dword [ebp + 0x80]
call dword [0x63faf0]
test eax, eax
je 0x414d14
mov dword [ebp - 0x460], esi
mov dword [ebp - 0x470], esi
cmp dword [ebp - 0x460], ebx
je 0x414e3c
lea eax, [ebp - 0x74]
push eax
push 0x64
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea esi, [ebp - 0x74]
cmp byte [ebp - 0x74], bl
je 0x414eac
jmp 0x414d3c
xor ebx, ebx
push 0x3e8
lea eax, [ebp - 0x45c]
push ebx
push eax
call fcn.00423750
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp dword [ebp - 0x470], ebx
je 0x414d80
cmp eax, 2
jne 0x414d80
push dword [ebp + 0x80]
lea eax, [ebp - 0x45c]
push eax
call dword [0x63fc0c]
push esi
push str._DRIVE_REMOVABLE_
jmp 0x414d99
push dword [ebp + 0x80]
lea eax, [ebp - 0x45c]
push eax
call dword [0x63fc0c]
push esi
push str._DRIVE_FIXED_
lea eax, [ebp - 0x45c]
call fcn.00411fc8
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x45c]
push eax
call dword [0x63fc0c]
mov eax, dword [ebp + 0x8c]
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp + 0x74]
mov dword [ebp - 0x464], eax
mov eax, dword [ebp + 0xa8]
sub esp, 0x68
lea ebx, [ebp + 0xc]
mov edi, esp
mov dword [ebp - 0x468], eax
call fcn.00401ced
xor ebx, ebx
push ebx
push dword [ebp + 0xa4]
lea eax, [ebp - 0x45c]
push dword [ebp - 0x460]
push dword [ebp + 0x9c]
push ebx
push dword [ebp + 0x98]
push dword [ebp - 0x46c]
push eax
push dword [ebp - 0x464]
push 0x43560f
push dword [ebp - 0x468]
call fcn.0041482c
add esp, 0x94
push esi
call dword [0x63fa78]
lea esi, [esi + eax + 1]
cmp byte [esi], bl
jne 0x414d3a
jmp 0x414eaa
mov eax, dword [ebp + 0x80]
mov esi, dword [ebp + 0x8c]
mov dword [ebp - 0x468], eax
mov eax, dword [ebp + 0x74]
mov dword [ebp - 0x464], eax
mov eax, dword [ebp + 0xa8]
sub esp, 0x68
lea ebx, [ebp + 0xc]
mov edi, esp
mov dword [ebp - 0x46c], eax
call fcn.00401ced
xor eax, eax
push eax
push dword [ebp + 0xa4]
push eax
push dword [ebp + 0x9c]
push eax
push dword [ebp + 0x98]
push esi
push dword [ebp - 0x468]
push dword [ebp - 0x464]
push 0x43561d
push dword [ebp - 0x46c]
call fcn.0041482c
add esp, 0x94
xor ebx, ebx
mov eax, dword [ebp - 0x474]
lea esi, [ebp + 0xc]
mov dword [eax], ebx
call fcn.00401cce
lea ecx, [ebp + 0x74]
call fcn.00414ed3
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041cb4c
leave
ret
Function at 0x4169d3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
push edi
lea eax, [ebp - 0x48]
call fcn.00416aac
test byte [0x63f9a4], 1
mov eax, dword [ebp + 0x40]
je 0x4169f2
mov eax, dword [ebp + 0x44]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0xc]
lea esi, [ebp - 0x20]
call fcn.00410445
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
xor edi, edi
lea eax, [ebp + 0x48]
lea esi, [ebp - 0x44]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call fcn.00410445
lea eax, [ebp + 0x1c]
lea esi, [ebp - 0x38]
call fcn.00410445
lea eax, [ebp + 0x28]
lea esi, [ebp - 0x2c]
call fcn.00410445
mov esi, 0x3e8
jmp 0x416a40
push esi
call dword [0x63f9ec]
cmp dword [0x63f9a4], 2
jae 0x416a39
inc dword [0x63f9a4]
cmp dword [0x63f9a0], edi
je 0x416a65
mov ecx, dword [ebp + 0x18]
push ebx
push dword [ebp + 0xc]
call fcn.0041c7fe
pop ecx
pop ecx
push edi
push edi
lea eax, [ebp - 0x48]
push eax
push 0x416902
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [ebp + 8]
push 0x4356df
call fcn.0041039f
lea esi, [ebp - 0x48]
call fcn.00416ad3
lea esi, [ebp + 0x1c]
call fcn.00401cce
mov eax, dword [ebp + 0xc]
call fcn.00402910
mov eax, dword [ebp + 8]
pop edi
pop esi
leave
ret
Function at 0x4180d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret

Function at 0x41a124
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov ebx, eax
mov dword [esi + 0x6af78], edi
cmp dword [esi + 0x6af70], edi
jne 0x41a152
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
push edi
push eax
mov dword [esi + 0x6af6c], edi
call fcn.00423750
mov eax, ebx
movzx ecx, word [eax*8 + 0x435142]
mov dword [esi + 0x6af98], ecx
movzx ecx, word [eax*8 + 0x435140]
mov dword [esi + 0x6af9c], ecx
movzx ecx, word [eax*8 + 0x435144]
mov dword [esi + 0x6afa0], ecx
movzx eax, word [eax*8 + 0x435146]
add esp, 0xc
mov dword [esi + 0x6af94], eax
cmp ebx, 2
jg 0x41a1b5
mov eax, dword [ebp + 8]
or word [eax], 4
jmp 0x41a1c1
cmp ebx, 8
jl 0x41a1c1
mov eax, dword [ebp + 8]
or word [eax], 2
push 0x10000
lea ebx, [esi + 0x1af70]
push ebx
push esi
mov dword [esi + 0x6af84], edi
mov dword [esi + 0x6af74], edi
call dword [esi + 0xc]
add esp, 0xc
mov dword [esi + 0x6af90], eax
cmp eax, edi
je 0x41a226
cmp eax, 0xffffffff
je 0x41a226
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x41a201
call fcn.0041a37c
mov dword [esi + 0x6af7c], edi
xor eax, eax
movzx ecx, byte [ebx + eax]
shl edi, 5
xor edi, ecx
and edi, 0x7fff
inc eax
mov dword [esi + 0x6af7c], edi
cmp eax, 2
jb 0x41a209
jmp 0x41a236
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41a48d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x41a68b
push edi
mov edi, 0x7fff
cmp dword [esi + 0x6af90], 3
jb 0x41a507
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, edi
mov dword [esi + 0x6af7c], eax
mov eax, dword [esi + eax*4 + 0x4af70]
and ecx, edi
mov dword [esi + ecx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af84]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af7c]
mov dword [esi + eax*4 + 0x4af70], ecx
cmp dword [ebp - 4], 0
je 0x41a54a
mov eax, dword [esi + 0x6af84]
sub eax, dword [ebp - 4]
cmp eax, 0x7efa
ja 0x41a54a
mov ecx, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], ecx
jbe 0x41a531
mov dword [esi + 0x6afa0], ecx
push dword [ebp - 4]
mov edx, esi
call fcn.0041a23b
mov ebx, eax
mov eax, dword [esi + 0x6af90]
pop ecx
cmp ebx, eax
jbe 0x41a54a
mov ebx, eax
cmp ebx, 3
jb 0x41a60b
mov edx, dword [esi + 0x6af84]
sub edx, dword [esi + 0x6af88]
lea ecx, [ebx - 3]
mov eax, esi
call fcn.00419bc2
sub dword [esi + 0x6af90], ebx
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x6af90]
cmp ebx, dword [esi + 0x6af98]
ja 0x41a5d8
cmp eax, 3
jb 0x41a5d8
dec ebx
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [esi + edx + 0x1af72]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
xor ecx, eax
and ecx, edi
mov dword [esi + 0x6af7c], ecx
mov ecx, dword [esi + ecx*4 + 0x4af70]
and edx, edi
dec ebx
mov dword [esi + edx*4 + 0x2af70], ecx
mov eax, dword [esi + 0x6af7c]
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
jne 0x41a586
jmp 0x41a62b
add dword [esi + 0x6af84], ebx
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [edx + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx edx, byte [edx + esi + 0x1af71]
shl ecx, 5
xor edx, ecx
xor ebx, ebx
and edx, edi
mov dword [esi + 0x6af7c], edx
jmp 0x41a631
mov eax, dword [esi + 0x6af84]
movzx ecx, byte [eax + esi + 0x1af70]
xor edx, edx
mov eax, esi
call fcn.00419bc2
dec dword [esi + 0x6af90]
mov dword [ebp - 8], eax
inc dword [esi + 0x6af84]
cmp dword [ebp - 8], 0
je 0x41a66c
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x41a64a
lea edx, [ecx + esi + 0x1af70]
jmp 0x41a64c
xor edx, edx
mov eax, dword [esi + 0x6af84]
push 0
sub eax, ecx
push edx
mov ecx, esi
call fcn.00419a45
mov eax, dword [esi + 0x6af84]
pop ecx
pop ecx
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x41a67d
call fcn.0041a37c
cmp dword [esi + 0x6af90], 0
jne 0x41a4b7
pop edi
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x41a69e
lea edx, [ecx + esi + 0x1af70]
jmp 0x41a6a0
xor edx, edx
mov eax, dword [esi + 0x6af84]
push 1
sub eax, ecx
push edx
mov ecx, esi
call fcn.00419a45
pop ecx
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x41b248
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, edx
test ecx, ecx
jne 0x41b253
xor eax, eax
pop edi
ret
push esi
not eax
mov edx, 0xff
cmp edi, 8
jb 0x41b307
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x435190]
movzx ebx, byte [ecx + 1]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x435190]
movzx ebx, byte [ecx + 2]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x435190]
movzx ebx, byte [ecx + 3]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x435190]
movzx ebx, byte [ecx + 4]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x435190]
movzx ebx, byte [ecx + 5]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x435190]
movzx ebx, byte [ecx + 6]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x435190]
movzx ebx, byte [ecx + 7]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x435190]
add ecx, 8
sub edi, 8
dec esi
jne 0x41b26a
pop ebx
test edi, edi
je 0x41b320
movzx esi, byte [ecx]
xor esi, eax
and esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0x435190]
inc ecx
dec edi
jne 0x41b30b
pop esi
not eax
pop edi
ret

Function at 0x41b325
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [ecx]
movsx edx, dl
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x435190]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x435190]
pop esi
mov dword [ecx + 8], eax
ret
Function at 0x41b8b6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
je 0x41b93c
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x41b8f0
cmp dword [esi + 0x40], ebx
jae 0x41b8f0
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp - 4]
mov ecx, 4
xor eax, eax
rep stosb byte es:[edi], al
and dword [esi + 0x3c], 0
xor edi, edi
cmp dword [esi + 0x3c], edi
jne 0x41b908
lea eax, [ebx + ebx]
push eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push dword [ebp + 8]
push dword [esi + 0x3c]
call fcn.00426b90
add esp, 0xc
test ebx, ebx
je 0x41b939
mov eax, dword [esi + 0x3c]
movzx eax, byte [edi + eax]
push eax
lea eax, [esi + 0x30]
push eax
call fcn.0041b383
pop ecx
pop ecx
mov ecx, dword [esi + 0x3c]
mov byte [edi + ecx], al
inc edi
cmp edi, ebx
jb 0x41b91b
mov edx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x41b96b
mov eax, dword [esi + 0x24]
lea edi, [eax + ebx]
cmp edi, dword [esi + 0x28]
jb 0x41b957
mov dword [esi + 0x14], 0x30000
jmp 0x41b98d
push ebx
push edx
add eax, ecx
push eax
call fcn.00426b90
add esp, 0xc
add dword [esi + 0x24], ebx
mov eax, ebx
jmp 0x41b98f
mov eax, dword [esi + 4]
test eax, eax
je 0x41b986
push 0
lea ecx, [ebp + 8]
push ecx
push ebx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
jmp 0x41b98f
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x41bda2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [esi + 0x84]
push edi
test ecx, ecx
je 0x41bdf3
mov eax, dword [esi + 0x8c]
mov edi, dword [esi + 0x88]
cmp eax, edi
jae 0x41be1b
sub edi, eax
cmp edi, dword [ebp + 8]
jbe 0x41bdca
mov edi, dword [ebp + 8]
push edi
add eax, ecx
push eax
push ebx
call fcn.00426b90
add esp, 0xc
add dword [esi + 0x8c], edi
mov eax, dword [esi + 0x78]
add dword [esi + 0x74], edi
mov edx, edi
mov ecx, ebx
call fcn.0041b248
mov dword [esi + 0x78], eax
mov eax, edi
jmp 0x41be1d
mov eax, dword [esi + 0x7c]
test eax, eax
je 0x41be14
push 0
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41be1b
mov edi, dword [ebp + 8]
jmp 0x41bddd
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop ebp
ret 4

Function at 0x41cb4c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43c078]
jne 0x41cb56
repz ret
jmp fcn.0041cec9
Function at 0x42536e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43c078]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004242a7
and dword [ebp - 0x14], 0
cmp dword [0x43f26c], 0
mov dword [ebp - 0x18], eax
jne 0x425421
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4254c9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4254c9
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x43f26c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x43f270], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x43f274], eax
call edi
push eax
call esi
mov dword [0x43f27c], eax
test eax, eax
je 0x425421
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x43f278], eax
mov eax, dword [0x43f278]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x42547a
cmp dword [0x43f27c], ecx
je 0x42547a
push eax
call esi
push dword [0x43f27c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x42547a
test ebx, ebx
je 0x42547a
call edi
test eax, eax
je 0x425471
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x425471
test byte [ebp - 8], 1
jne 0x42547a
or dword [ebp + 0x10], 0x200000
jmp 0x4254ad
mov eax, dword [0x43f270]
cmp eax, dword [ebp - 0x18]
je 0x4254ad
push eax
call esi
test eax, eax
je 0x4254ad
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4254ad
mov eax, dword [0x43f274]
cmp eax, dword [ebp - 0x18]
je 0x4254ad
push eax
call esi
test eax, eax
je 0x4254ad
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43f26c]
call esi
test eax, eax
je 0x4254c9
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4254cb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041cb4c
leave
ret
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x41866e2b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x6e937003
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x48a87a
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
or al, 0xd6
fsubr dword [eax + 0x52613290]
shr byte [eax - 0x3c], 1
dec ebp
push edx
aam 3
xchg edi, eax
mov byte [0x7c2500fb], al
or edx, esi
rol byte [esp], 1
sub al, 0x65
stc
leave
mov al, byte [0x52219093]
xchg ebx, eax
add byte [esi + 0x68], 0xd6
add al, 0x53
xor ecx, dword [eax + 0x7da984e8]
push edx
jnp 0x48a8af
push ecx
js 0x48a905
test al, 0xbf
mul byte [ebx + eax - 0x7940231f]
mov esp, 0x96bab373
invalid
mov dword [0x20e7c41d], eax
adc byte [ebx + 0x1b43042d], ah
sub esp, dword [ebx - 0x115cfd71]
test dword [ebx + ebx*4 - 0x49fb6d80], 0x4ce69751
sub eax, 0xb2e507a
adc esi, edx
lodsb al, byte [esi]
sbb esi, dword [edx + 0x5847e6b0]
in al, 1
xchg edx, eax
adc dl, al
sub ah, 0x80
in al, 0xe2
mov al, byte [0xa6f3f166]
mov al, 0xb7
fmul qword gs:[ebx]
xor eax, 0xd89fb9
leave
sbb dword [ebp - 0x13], 0xffffffdb
cmp eax, 0x97e0f15
jmp 0xf5319d6c

Function at 0x4d2510
Capabilities:
Encode data using xor

Disassembly:
rol byte [edx], cl
xchg ebp, eax
add dword [ecx + 0x31], 0xffffffe1
invalid
xor ecx, esp
loope 0x4d250a
clc
inc ebp
xor esi, edi
fcom dword [ebp - 0x4b]
sbb byte [edx], 0xa2
jecxz 0x4d250f
mov esp, dword [edx + 0x100b4853]
mov bl, 0x31
jo 0x4d254d
and ecx, dword [ebx - 0x2f]
rol byte [ebx + 0x76], 1
inc esp
pop ss
cmp ch, byte [eax + 0xbc0b3dc]
fadd qword [edx]
sbb dl, 0x3d
sbb al, 0xe2
add eax, 0xd070f2a1
pop ebp
jo 0x4d25b6
xchg ecx, eax
cmp eax, 0x50034353
or al, 0x73
pop esi
jae 0x4d25ad
xor esp, edx
cmc
inc ebx
add byte [ecx], cl
push cs
invalid
adc byte [ebx], ah
jbe 0x4d25d6
xchg esp, eax
push esi
stosb byte es:[edi], al
inc edx
sub al, 0xae
hlt
xchg ebp, eax
push 0xffffffffffffffc1
adc byte [edx - 0x53], al
cmp dh, byte [esi]
ror edi, cl
into
out 0x11, al
into
mov eax, dword [0x7074bb39]
push edi
mov cl, dl
fisub dword [ebp + 0x5b547b0f]
invalid
jae 0x4d25ab
or bl, byte [edx]
adc eax, dword [esi + 0x1bf6e2f2]
salc
mov ss, edx
jp 0x4d25b7
outsd dx, dword [esi]
sub cl, byte [edi]
pushfd
mov ebx, 0x2471b285
ret

Function at 0x536870
Capabilities:
Encode data using xor

Disassembly:
add bl, byte [esi + edx - 0x96fc509]
in al, dx
mov byte [ebx + 0xed6eae5], 0xe4
xchg ecx, eax
and ebp, 0xffffffea
salc
push cs
in al, 0x91
xchg esp, eax
inc ebx
push ds
adc byte [ecx - 0x6d], dl
test dword [esi - 9], esp
xor al, 0xcb
mov esp, 0xb4b933f5
js 0x536879
push edi
adc ecx, eax
and dl, byte [ecx]
ret 0x9367