joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406290
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x2c
cmp word [eax], 0
je 0x406410
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4062a8
sub eax, ebx
sar eax, 1
lea eax, [eax*8 + 2]
call sym._xmalloc
mov esi, eax
movzx eax, word [ebx]
test ax, ax
je 0x406430
xor edx, edx
jmp 0x406331
ja 0x4063c0
cmp ax, 0x3c
ja 0x4063f8
cmp ax, 0x1f
jbe 0x4063e0
sub eax, 0x20
mov ecx, 0x180007dd
bt ecx, eax
jae 0x4063d7
mov eax, dword [ebp - 0x1c]
mov ecx, 0x5c
lea edi, [edx + 2]
mov edx, 0x5c
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov word [eax], dx
movzx eax, word [ebx]
add ebx, 2
lea edx, [edi + 1]
mov word [esi + edi*2], ax
movzx eax, word [ebx]
test ax, ax
je 0x406380
lea edi, [edx + edx]
lea ecx, [esi + edi]
mov dword [ebp - 0x1c], ecx
lea ecx, [esi + edi + 2]
mov dword [ebp - 0x20], ecx
cmp ax, 0x5c
jne 0x4062d8
mov eax, dword [ebp - 0x1c]
mov ecx, 0x5c
add ebx, 2
add edx, 4
mov word [eax], cx
lea eax, [esi + edi + 2]
mov ecx, 0x5c
mov word [eax], cx
mov eax, 0x5c
mov word [esi + edi + 4], ax
mov eax, 0x5c
mov word [esi + edi + 6], ax
movzx eax, word [ebx]
test ax, ax
jne 0x406331
lea eax, [esi + edx*2]
xor edx, edx
mov word [eax], dx
mov dword [esp], esi
call dbg.wchars_to_utf8_chars
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub eax, 0x60
cmp ax, 0x1e
ja 0x4063d7
mov ecx, 0x50000001
bt ecx, eax
jb 0x406303
mov edi, edx
jmp 0x40631c
sub eax, 9
mov edi, edx
cmp ax, 1
ja 0x40631c
jmp 0x406303
sub eax, 0x3e
mov edi, edx
cmp ax, 1
ja 0x40631c
jmp 0x406303
mov eax, 2
call sym._xmalloc
mov esi, eax
movzx eax, word [ebx]
test ax, ax
jne 0x4062cf
lea esi, [esi]
nop
mov eax, esi
jmp 0x406383
Function at 0x406ba0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov dword [esp], eax
call dbg.wchars_to_utf8_chars
mov dword [ebp - 0x1c], eax
mov edi, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_strlen]
lea eax, [eax + eax*2]
lea eax, [eax + eax + 1]
call sym._xmalloc
movzx edx, byte [edi]
mov esi, eax
test dl, dl
je 0x406cd0
add edi, 1
xor ebx, ebx
lea esi, [esi]
lea eax, [edx - 0x22]
lea ecx, [esi + ebx]
cmp al, 0x1c
ja case.0x406bed.1
movzx eax, al
jmp dword [eax*4 + 0x40ecc8]
mov byte [ecx], dl
add ebx, 1
lea esi, [esi]
movzx edx, byte [edi]
add edi, 1
test dl, dl
jne 0x406be0
add ebx, esi
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [ebx], 0
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], str.gt_
mov dword [esp], ecx
call sym._sprintf
add ebx, eax
jmp 0x406c00
mov dword [esp + 4], str.lt_
mov dword [esp], ecx
call sym._sprintf
add ebx, eax
jmp 0x406c00
mov dword [esp + 4], str.apos_
mov dword [esp], ecx
call sym._sprintf
add ebx, eax
jmp 0x406c00
mov dword [esp + 4], str.amp_
mov dword [esp], ecx
call sym._sprintf
add ebx, eax
jmp 0x406c00
mov dword [esp + 4], str.quot_
mov dword [esp], ecx
call sym._sprintf
add ebx, eax
jmp 0x406c00
mov ebx, eax
jmp 0x406c0c
Function at 0x40c1f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x40c24b
cmp byte [esi + ebx - 1], 0xa
je 0x40c21f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4172c4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x40c7a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x4172d4]
mov esi, dword [ebp + 8]
test edi, edi
je 0x40c960
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x4172d4]
movzx eax, al
bt eax, esi
jae 0x40c9c0
mov ecx, dword [0x4172c4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x40c866
test byte [0x40d02c], 8
jne 0x40c900
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x40d03c], 8
jne 0x40c8b0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x40c835
cmp esi, 3
jbe 0x40c870
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 8], str._s:_s:_s
lea edx, [edi + 1]
mov dword [esp], eax
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x416af8]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x40c835
mov ecx, dword [0x4172d4]
test ecx, ecx
je 0x40c9a0
mov dword [esp], 0x40d03c
call dword [0x4172d4]
test al, 8
je 0x40c80c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x40c80c
mov ebx, dword [0x4172d4]
test ebx, ebx
je 0x40c980
mov dword [esp], 0x40d02c
call dword [0x4172d4]
test al, 8
je 0x40c7f9
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x40c7ff
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4172d4
call sym._load_func.part.0
jmp 0x40c7c0
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4172d4
call sym._load_func.part.0
jmp 0x40c90a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4172d4
call sym._load_func.part.0
jmp 0x40c8be
mov eax, 0xffffffff
jmp 0x40c866
Function at 0x40cb20
Capabilities:
Accept command line arguments
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.wmain
mov dword [esp], eax
call sym._exit

Function at 0x40cb90
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x40cbf7
xor ecx, ecx
xor edx, edx
jmp 0x40cbd9
cmp ax, 0x5c
jne 0x40cc68
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x40cbf7
cmp ax, 9
je 0x40cbe5
cmp ax, 0x20
jne 0x40cbc0
test ecx, ecx
je 0x40cc53
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x40cbd9
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x40cc88
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dbg.wWinMain@16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x40cc50
cmp ax, 0x20
je 0x40cc50
jmp 0x40cbf7
cmp ax, 0x22
jne 0x40cbe9
and edx, 1
jne 0x40cbe9
xor ecx, 1
jmp 0x40cbcd
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x40cc10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x7d8058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.007d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d806a
add dl, dl
jne 0x7d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d80dc
xor eax, eax
add dl, dl
jne 0x7d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d817d
add dl, dl
jne 0x7d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7d8075
mov eax, 1
add dl, dl
jne 0x7d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d80e1
sub eax, ebx
mov ebx, 1
jne 0x7d8128
mov ecx, 1
add dl, dl
jne 0x7d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8136
cmp eax, 0x7d00
jae 0x7d816d
cmp eax, 0x500
jb 0x7d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
cmp eax, 0x7f
ja 0x7d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x431006
Capabilities:
Check for software breakpoints
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x10001120
Capabilities:
Enumerate gui resources
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10007f08
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x1000b018]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, dword [0x1000c8d0]
push 0
push 0x100010f0
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0x1000a08c
push 0x65
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x100012f3
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push ebx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esp + 0x14], eax
cmp eax, 0x64
jbe 0x100012f3
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
cmp byte [ebx], 0x10
mov dword [esp + 0x1c], ebx
jne 0x100012db
xor esi, esi
lea eax, [esi + 0x10]
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
call fcn.10001a80
mov dword [esp + 0x60], esi
xor eax, eax
lea ecx, [ecx]
mov cl, byte [ebx + eax + 1]
mov edx, dword [esp + 0x34]
mov byte [edx + eax], cl
inc eax
cmp eax, 0x10
jl 0x100011d0
mov eax, 0x10
lea ecx, [esp + 0x44]
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
call fcn.10001a80
xor eax, eax
mov byte [esp + 0x60], 1
mov esi, dword [esp + 0x44]
lea edi, [eax + 0x21]
lea esp, [esp]
mov cl, byte [ebx + eax + 0x11]
mov byte [esi + eax], cl
inc eax
cmp eax, 0x10
jl 0x10001210
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x14]
add eax, 0xffffffdf
lea ecx, [esp + 0x24]
call fcn.10001a80
mov byte [esp + 0x60], 2
mov ecx, dword [esp + 0x28]
xor eax, eax
sub ecx, dword [esp + 0x24]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], ecx
je 0x10001296
jmp 0x1000125a
mov ebx, dword [esp + 0x1c]
cmp edi, dword [esp + 0x14]
jae 0x10001296
movzx edx, byte [edi + ebx]
mov cl, byte [esi + eax]
mov ebx, dword [esp + 0x24]
mov byte [esi + eax], dl
mov edx, dword [esp + 0x34]
movzx edx, byte [edx + eax]
xor dl, byte [esi + eax]
inc eax
xor dl, cl
mov ecx, dword [esp + 0x18]
inc edi
mov byte [ebx + ecx], dl
cmp eax, 0x10
jl 0x1000128b
xor eax, eax
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, dword [esp + 0x20]
jb 0x10001256
mov eax, dword [esp + 0x24]
push eax
call fcn.100017a0
mov edi, eax
mov eax, dword [esp + 0x28]
add esp, 4
test eax, eax
je 0x100012b6
push eax
call fcn.10001d60
add esp, 4
test esi, esi
je 0x100012c3
push esi
call fcn.10001d60
add esp, 4
mov dword [esp + 0x60], 0xffffffff
mov eax, dword [esp + 0x34]
test eax, eax
je 0x100012e6
push eax
call fcn.10001d60
jmp 0x100012e3
push ebx
call fcn.100017a0
mov edi, eax
add esp, 4
test edi, edi
je 0x100012f3
mov ecx, edi
call fcn.10001970
call eax
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100017a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x100017c2
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [eax + 0x3c]
add edi, eax
cmp dword [edi], 0x4550
jne 0x100017db
mov edx, 0x14c
cmp word [edi + 4], dx
je 0x100017ed
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x50]
mov ecx, dword [edi + 0x34]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x3000
push eax
push ecx
call esi
mov ebx, eax
test ebx, ebx
jne 0x10001831
mov edx, dword [edi + 0x50]
push 4
push 0x3000
push edx
push eax
call esi
mov ebx, eax
test ebx, ebx
jne 0x10001831
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push 0x30
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
xor eax, eax
cmp esi, eax
jne 0x10001869
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov dword [esi + 4], ebx
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], eax
movzx ecx, word [edi + 0x16]
shr ecx, 0xd
push 4
and ecx, 1
mov dword [esi + 0x14], ecx
mov dword [esi + 0x1c], 0x10001760
mov dword [esi + 0x20], 0x10001770
mov dword [esi + 0x24], 0x10001790
mov dword [esi + 0x28], eax
mov edx, dword [edi + 0x54]
push 0x1000
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [edi + 0x54]
mov edx, dword [ebp + 8]
push ecx
push edx
push eax
mov dword [ebp - 4], eax
call fcn.10005b50
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
add eax, dword [ebp - 4]
push esi
push edi
mov dword [esi], eax
push ecx
mov dword [eax + 0x34], ebx
call fcn.10001310
mov eax, ebx
add esp, 0x18
sub eax, dword [edi + 0x34]
je 0x100018ed
push eax
mov ecx, esi
call fcn.100014d0
add esp, 4
mov dword [esi + 0x18], eax
jmp 0x100018f4
mov dword [esi + 0x18], 1
call fcn.10001560
test eax, eax
je 0x10001934
push esi
call fcn.100013c0
add esp, 4
mov eax, esi
call fcn.10001490
mov eax, dword [esi]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x1000195e
add eax, ebx
cmp dword [esi + 0x14], 0
je 0x10001952
push 0
push 1
push ebx
call eax
test eax, eax
jne 0x10001942
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.100016d0
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x10], 1
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x2c], eax
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x2c], 0
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10001bdc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000b018]
jne 0x10001be6
repz ret
jmp fcn.10002693
Function at 0x100065a7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1000b018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10003512
and dword [ebp - 0x14], 0
cmp dword [0x1000c8b4], 0
mov dword [ebp - 0x18], eax
jne 0x1000665a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10006702
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10006702
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1000c8b4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1000c8b8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1000c8bc], eax
call edi
push eax
call esi
mov dword [0x1000c8c4], eax
test eax, eax
je 0x1000665a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1000c8c0], eax
mov eax, dword [0x1000c8c0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x100066b3
cmp dword [0x1000c8c4], ecx
je 0x100066b3
push eax
call esi
push dword [0x1000c8c4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x100066b3
test ebx, ebx
je 0x100066b3
call edi
test eax, eax
je 0x100066aa
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x100066aa
test byte [ebp - 8], 1
jne 0x100066b3
or dword [ebp + 0x10], 0x200000
jmp 0x100066e6
mov eax, dword [0x1000c8b8]
cmp eax, dword [ebp - 0x18]
je 0x100066e6
push eax
call esi
test eax, eax
je 0x100066e6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100066e6
mov eax, dword [0x1000c8bc]
cmp eax, dword [ebp - 0x18]
je 0x100066e6
push eax
call esi
test eax, eax
je 0x100066e6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1000c8b4]
call esi
test eax, eax
je 0x10006702
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10006704
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001bdc
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x42660b
Capabilities:
Terminate process

Disassembly:
call fcn.00426618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x109f0
Capabilities:
Create device object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0x109c0
lea eax, [ebp - 0xf8]
push eax
call dword [sym.imp.ntoskrnl.exe_wcscpy]
add esp, 8
lea ecx, [ebp - 0xf8]
push ecx
call fcn.00016380
lea edx, [ebp - 0xf8]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x22
lea edx, [ebp - 0x108]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
je 0x10a53
xor al, al
jmp 0x10aa7
push 0x109d4
lea ecx, [ebp - 0x80]
push ecx
call dword [sym.imp.ntoskrnl.exe_wcscpy]
add esp, 8
lea edx, [ebp - 0x80]
push edx
call fcn.00016380
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
test eax, eax
je 0x10aa5
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
xor al, al
jmp 0x10aa7
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x10d40
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push edi
mov ecx, 0x34
xor eax, eax
mov edi, dword [ebp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0xc3d2e1f0
pop edi
pop ebp
ret 4