joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b6a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, 0x6b
mov edx, 0x72
mov word [0x7c5a90], ax
mov word [0x7c5a94], dx
mov ecx, 0x6e
mov edx, 0x65
xor eax, eax
push 0x7c5a90
mov dword [0x7c5a9c], 0x320033
mov dword [0x7c5aa4], 0x6c006c
mov word [0x7c5a96], cx
mov dword [0x7c5a98], 0x6c0065
mov dword [0x7c5aa0], 0x64002e
mov word [0x7c5a92], dx
mov word [0x7c5aa8], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [0x7c5a8c]
lea ecx, [esp]
push ecx
push 0x40
mov dword [0x7c5a88], eax
mov eax, dword [0x446adc]
push edx
push eax
mov byte [0x441d53], 0x65
mov dword [0x441d49], 0x75747269
mov word [0x441d4d], 0x6c61
mov byte [0x441d48], 0x56
mov word [0x441d54], 0x7463
mov byte [0x441d56], 0
mov dword [0x441d4f], 0x746f7250
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x43b790
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x148c
call fcn.0040cf30
cmp dword [0x7c5a8c], 0x37
jne 0x43b865
push 0
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x4046b4
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
mov ecx, dword [esp + 4]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
push 0
lea edx, [esp + 0x48c]
push edx
push 0x4046c4
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0
lea eax, [esp + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 0xc]
push edx
push 0x4046ec
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
push 0
lea ecx, [esp + 0xc8c]
push ecx
push 0
push 0x4046f8
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0x404724
push 0x404740
push 0x404750
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
mov edx, dword [0x7c6a80]
mov dword [esp + 4], edx
mov eax, 0x5d1
add dword [esp + 4], eax
mov eax, dword [esp + 4]
mov cl, byte [eax + esi]
mov edx, dword [0x446adc]
mov byte [edx + esi], cl
add esp, 0x148c
ret
Function at 0x43ba00
Capabilities:
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x7c5a8c]
sub esp, 0x2dc
push ebx
push ebp
push esi
mov esi, dword [0x446adc]
shr eax, 3
push edi
test eax, eax
je 0x43bbac
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], eax
jmp 0x43ba34
mov esi, dword [esp + 0x18]
cmp dword [0x7c5a8c], 0x1c
jne 0x43ba51
lea eax, [esp + 0x38]
push eax
push 0
lea ecx, [esp + 0x44]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov edx, dword [0x440210]
mov ecx, dword [0x440214]
mov eax, dword [esi]
mov edi, dword [esi + 4]
mov dword [esp + 0x28], edx
mov edx, dword [0x440218]
mov dword [esp + 0x2c], ecx
mov ecx, dword [0x44021c]
mov dword [esp + 0x14], eax
mov ebx, 0xc6ef3720
mov dword [esp + 0x24], edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x1c], 0x20
jmp 0x43ba95
mov eax, dword [esp + 0x14]
mov edx, eax
mov ecx, eax
shr edx, 5
add edx, dword [esp + 0x34]
shl ecx, 4
add ecx, dword [esp + 0x24]
add eax, ebx
xor edx, ecx
xor edx, eax
sub edi, edx
mov ecx, edi
shl ecx, 4
mov dword [0x7c59fc], 0
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x28]
add dword [esp + 0x10], eax
cmp dword [0x7c5a8c], 0x1be
lea ebp, [ebx + edi]
jne 0x43baea
lea edx, [esp + 0x30]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov esi, edi
shr esi, 5
add esi, dword [esp + 0x2c]
cmp dword [0x7c5a8c], 0x979
mov dword [0x7c5a00], 0xff6b3619
mov dword [0x7c5a04], 0xffffffff
jne 0x43bb2a
mov eax, dword [esp + 0x30]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
xor esi, ebp
xor dword [esp + 0x10], esi
mov eax, dword [esp + 0x10]
sub dword [esp + 0x14], eax
add ebx, 0x61c88647
dec dword [esp + 0x1c]
jne 0x43ba91
cmp dword [0x7c5a8c], 0x8d4
jne 0x43bb5f
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov dword [esi], edx
mov dword [esi + 4], edi
cmp dword [0x7c5a8c], 0x17
jne 0x43bb9b
push 0
push 0
push 0
push 0x404690
push 0x4046a0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
lea eax, [esp + 0x98]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
add esi, 8
dec dword [esp + 0x20]
mov dword [esp + 0x18], esi
jne 0x43ba30
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2dc
ret
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x414fb0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x41515a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x37
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x4d
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x32
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa0
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x2f
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0x4a
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xd
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x35
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xda
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x2a
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x14
add esp, 0x40
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x22
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xc7
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xc3
push str.Protocol_of_Mind
push 0x4d24a8
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xbe
add esp, 0x30
inc esi
cmp esi, edi
jb 0x414fd0
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x453329
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45333a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405920
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c7e2
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c7f3
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c6c9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c81b
push ebx
push esi
push edi
call fcn.00405713
add esp, 0xc
push 0
call fcn.00406262
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x408ac2
Capabilities:
Receive data
Receive data on socket

Disassembly:
pop ebp
ret
in al, dx
sub esp, 0xc
xchg ebx, eax
dec ebp
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebx + 0x45b04d8b], ebx
add byte [ebx - 0x72ff95fa], cl
push ebp
xchg edi, eax
mov dword [ebp - 0xc], eax
push 0
test al, 0x8b
push ecx
sbb byte [ebp + 0x16af445], cl
push eax
push edx
mov dword [ebp - 4], 0
call dword [0x94c198]
cmp eax, 0xffffffff
jne 0x408abc
insd dword es:[edi], dx
mov edi, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
call edi
test eax, eax
jne 0x408b15
mov dword [esi], eax
pop edi
pop esi
nop
in eax, 0x5d
ret 0x80
clc
xlatb
mov dword [esi], 0
test dword [0xafc80], 0x5ce58b5e
push 0x57
sahf
mov esp, dword [esi]
cld
mov dword [esi], eax
xor edi, dword [esi + ebx*2 - 0xea21a75]
or al, 0x60
nop
nop
nop
nop
push cs
nop
nop
nop
rcr dword [esp + ebp*8 - 0x74ef137d], cl
dec ebp
or al, 0x56
mov esi, dword [ebp + 0x10]
push 0xffffffffffffffe3
cdq
xor al, 0xf8
push edx
add byte [ebx - 0x2574adfa], cl
or byte [ecx + 0x451bf055], cl
cld
mov dword [ebp - 0xc], ecx
push eax
mov esi, dword [ebp - 0xfb272fc]
push 1
push ecx
push eax
invalid
Function at 0x40a6ce
Capabilities:
Encode data using xor

Disassembly:
and cl, al
inc eax
add byte [ebx - 0x3b7c07b3], cl
or byte [ebx], bh
rcr dword [esi - 0x4a], 0x31
sub eax, ecx
dec ecx
enter 0xffffffffffffc033, 0xffffffffffffff85
cmpsd dword [esi], dword es:[edi]
jle 0x40a70e
mov eax, dword [ecx - 0x762efc79]
adc al, 0xd
js 0x40a72c
mov ecx, 0x7c8bf37c
or byte [ebx + 0x339b095], cl
pop ebx
mov esp, ebp
pop ebp
ret
mov ebp, dword [esi - 0x74c776f8]
ret
jne 0x40a84d
test dword [ebx], ebx
add dword [eax], eax
add byte [eax - 8], ch
wait
inc ecx
add bh, al
add eax, 0x415e18
xchg esp, eax
add ah, al
add bh, bh
adc eax, fcn.00403276
push 0x419bf8
mov dword [0x415e18], 0xc40094
call dword [fcn.00403276]
mov eax, dword [0xaa08d5]
cmp eax, 2
jne 0x40a88d
mov al, byte [0x41080c]
xchg ebp, eax
or al, 8
inc ecx
add byte [eax + eax*8 + 0x3dd73b74], al
push 0xa10040c1
je 0x40a72d
mov eax, dword [0x8640c174]
cmp dword [eax], 4
jle 0x40a7c8
inc eax
xchg byte [ebx + 0x557e0438], al
xor ecx, ecx
push 4
push ss
call 0x84189e3f
das
or bl, ch
mov esp, 0x40c178a1
add byte [ebx], dh
xor cl, byte [edx - 0x75f774ea]
lodsb al, byte [esi]
push ecx
and eax, 4
test dword [ecx - 0x2175c98b], eax
add dword [esp + eax*4 - 0x40], esp
jne 0x40a769
mov ecx, dword [0x554108e0]
xor al, 0xfc
pop es
lock add byte [ebx - 0x7df03422], al
pop edi
add dword [eax], eax
add byte [edi], cl
test byte [ecx + 1], bl
add byte [eax], al
cmp eax, 4
jne 0x40a822
sub dword [ecx], 2
jae 0x40a7d3
mov eax, 0x8128
jmp 0x40a916
dec edx
add dword [eax], eax
add byte [eax - 0x32574cc2], al
push esi
call dword [sym.imp.MSVCRT.dll_atoi]
adc eax, sym.imp.MSVCRT.dll_atoi
mov ecx, eax
add esp, 0x25
mov al, byte [0x4192e00d]
add bl, ch
mov edi, 0x2ab80a77
dec esp
add byte [edx], dh
jmp 0x40a916
and al, bh
add eax, 0xbba15575
or byte [ecx], al
test eax, eax
fisubr word [ebp + eax*4 - 0x37]
lock add ch, byte [0xf00032]
add ch, byte [0xf00032]
jmp 0x40a916
add byte [ebx - 0x418afd08], al
mov eax, 0x410046
jmp 0x40a916
cmp eax, 1
cli
jg 0x40a833
or al, 8
inc ecx
add byte [esi + 0x41080c], bh
test al, al
je 0x40a8db
mov edi, dword [sym.imp.MSVCRT.dll__isctype]
mov eax, dword [0x6dacc17d]
sbb dword [esi + 0x7e], 0x7e
push cs
xor ecx, ecx
push 1
mov cl, byte [esi]
push ecx
call edi
add esp, 0x19
jmp 0x40a8cf
test dword [ebx + 0x75], esp
or byte [edx - 0x7bb9feba], cl
add dword [esi - 0x7c], eax
sal byte [ebp - 0x35], 0x79
clc
jns 0x40a8d5
or byte [ecx], al
cmp eax, 0x65
jae 0x40a8f5
mov cl, byte [esi]
xor eax, eax
and byte [eax + eax - 0x723f627f], 0x44
add byte [edx], cl
jmp 0x40a916
push edx
rcr byte [edx + 0x73], cl
adc byte [edx - 0x1c3fccf2], cl
push ecx
inc ecx
setge al
lea ecx, [eax]
push cs
jmp 0x40a916
invalid
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x45b23a05
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x27d040b1
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412d00
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x412eaa
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
sub byte [esi + ebx], 9
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xd3
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xbe
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 4
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa6
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0xe4
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xe9
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xb
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xbf
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x8a
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xc
add esp, 0x40
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x93
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xe9
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xa6
push str.Protocol_of_Mind
push 0x5070b0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xc4
add esp, 0x30
inc esi
cmp esi, edi
jb 0x412d20
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x451bc9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451bda
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405907
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b072
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b083
pop esi
ret
push ebx
push edi
push esi
call fcn.0049af59
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fda
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b0ab
push ebx
push esi
push edi
call fcn.004056fa
add esp, 0xc
push 0
call fcn.00406244
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
sub ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
pop edi
cmp edi, ebx
jne 0x40b525
sub eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
test eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
test eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
test eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x438cac
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x438a14
add edx, 0xe0dbe8ef
mov eax, 0x5e82a267
call fcn.00438ce5
add eax, 0x8d817b87
xor dword [ebx], esi
mov eax, eax
sub edx, eax
inc ebx
add eax, eax
add edx, edx
cmp ebx, edi
jne fcn.00438cac
dec eax
add eax, 0x931fb61d
inc eax
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x43506f0
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x4304d8
mov ecx, 0x176a2038
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..reloc
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x7e2f7e56
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
mov ecx, 0x718b5e87
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..pdata
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x55507dd0
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0xa1b7b8a
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4016f3
Capabilities:
Set socket configuration

Disassembly:
add byte [esi + 6], dh
inc eax
add byte [ebp - 0x20ffbf88], al
adc al, 0x40
add bl, dh
adc al, 0x40
add byte [esi], dl
push ebx
inc eax
and eax, dword [eax]
sbb eax, dword [ecx]
out dx, al
sbb ebx, dword [ebx]
sbb eax, dword [edx]
inc esp
sbb ebx, dword [ebx]
sbb ebx, dword [ebx]
sbb ebx, dword [ebx]
add ebx, dword [ebx]
salc
add al, 0xda
sbb eax, dword [esi]
sbb eax, dword [edi]
lodsb al, byte [esi]
sbb ebx, dword [ebx]
sbb ebx, dword [ebx]
mov eax, dword [0x81be41d]
or dword [edi + 0xb], esi
sbb ecx, dword [ecx + 0x1b0f1b0e]
das
adc byte [ebx], bl
adc dword [edi], ebp
adc ebx, dword [ebx]
adc al, 0x15
push ss
pop ss
sbb byte [ecx], bl
adc edx, dword [eax + 0x73906cef]
nop
nop
adc byte [bx + si - 0x4670], dl
nop
inc ecx