joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402050
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x402059
mov eax, dword [ebp - 4]
add esp, 0xffffffcc
push ebx
cmp dword [0x40c38c], 0
jne 0x40207a
mov al, 1
jmp 0x402176
xor edx, edx
lea ecx, [ebp - 4]
mov dword [ebp - 4], edx
xor edx, edx
mov dword [ebp - 0x20], edx
push ecx
lea ebx, [ebp - 0x10038]
push 0x10014
push ebx
push 5
push eax
call sub.ADVAPI32.DLL_GetFileSecurityW
test eax, eax
je 0x402127
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.ADVAPI32.DLL_GetSecurityDescriptorOwner
test eax, eax
je 0x402127
push dword [0x41097c]
push dword [ebp - 0x24]
call sub.ADVAPI32.DLL_EqualSid
test eax, eax
je 0x402127
lea edx, [ebp - 8]
lea ecx, [ebp - 0xa]
push edx
push ecx
push ebx
call sub.ADVAPI32.DLL_GetSecurityDescriptorControl
test eax, eax
je 0x402127
test byte [ebp - 9], 0x10
jne 0x4020e6
test byte [ebp - 9], 4
jne 0x402127
test byte [ebp - 0xa], 4
je 0x402127
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x10]
push ecx
push ebx
call sub.ADVAPI32.DLL_GetSecurityDescriptorDacl
test eax, eax
je 0x402127
cmp dword [ebp - 0x18], 0
je 0x402127
mov eax, dword [ebp - 0x18]
cmp word [eax + 4], 1
jne 0x402127
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x1c]
push edx
push ecx
push dword [ebp - 0x18]
call dword [0x40c38c]
test eax, eax
je 0x40212b
mov al, 1
jmp 0x402176
xor ebx, ebx
cmp dword [ebp - 0x1c], 1
jne 0x402164
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
and edx, 0x1f01ff
cmp edx, 0x1200a9
jne 0x402164
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + 4], 1
jne 0x402164
push dword [0x410978]
mov eax, dword [ebp - 0x20]
push dword [eax + 0x1c]
call sub.ADVAPI32.DLL_EqualSid
test eax, eax
jne 0x402166
mov bl, 1
cmp dword [ebp - 0x20], 0
je 0x402174
push dword [ebp - 0x20]
call sub.KERNEL32.DLL_LocalFree
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4021a0
Capabilities:
Delete file
Move file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, 0x40cc7c
call fcn.00404904
push 0
lea edx, [ebp - 0x2c]
push edx
push 0
push 1
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetControlSession_Manager
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExW
test eax, eax
jne 0x4022d8
xor ecx, ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], ecx
push eax
push 0
push 0
push 0
push 0x40c22a
push dword [ebp - 0x2c]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov word [ebp - 0x18], 8
mov edi, dword [ebp - 0x30]
mov eax, dword [0x410560]
inc edi
shr edi, 1
add edi, edi
mov dword [ebp - 0x34], edi
push dword [ebp - 0x34]
push 0
push dword [eax]
call sub.KERNEL32.DLL_HeapAlloc
mov dword [ebp - 4], eax
lea edx, [ebp - 0x30]
inc dword [ebp - 0xc]
mov word [ebp - 0x18], 0x14
push edx
push dword [ebp - 4]
push 0
push 0
push str.PendingFileRenameOperations
push dword [ebp - 0x2c]
call sub.ADVAPI32.DLL_RegQueryValueExW
test eax, eax
jne 0x4022ba
cmp dword [ebp - 0x30], 0
je 0x4022ba
mov ecx, 2
mov eax, dword [ebp - 0x30]
xor edx, edx
div ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x30]
mov word [ecx + eax*2 - 2], 0
jmp 0x402271
mov edx, dword [ebp - 4]
mov word [edx + edi*2], 0x20
push dword [ebp - 4]
call sub.KERNEL32.DLL_lstrlenW
mov edi, eax
mov edx, dword [ebp - 0x30]
dec edx
cmp eax, edx
jb 0x402268
push esi
push dword [ebp - 4]
call fcn.00404854
add esp, 8
test eax, eax
je 0x4022ba
push dword [ebp - 0x2c]
call sub.ADVAPI32.DLL_RegCloseKey
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004023a0
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
jmp 0x402342
push dword [ebp - 0x2c]
call sub.ADVAPI32.DLL_RegCloseKey
dec dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004023a0
mov word [ebp - 0x18], 0
push ebx
call sub.KERNEL32.DLL_DeleteFileW
test eax, eax
jne 0x4022f6
xor ecx, ecx
mov edx, 0x10000000
mov eax, ebx
call fcn.00401f74
push ebx
call sub.KERNEL32.DLL_DeleteFileW
push ebx
push esi
call sub.KERNEL32.DLL_MoveFileW
test eax, eax
je 0x40230d
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
jmp 0x402342
xor ecx, ecx
mov edx, 0x10000000
mov eax, esi
call fcn.00401f74
push ebx
push esi
call sub.KERNEL32.DLL_MoveFileW
test eax, eax
jne 0x402339
push 4
push 0
push ebx
call sub.KERNEL32.DLL_MoveFileExW
push 4
push ebx
push esi
call sub.KERNEL32.DLL_MoveFileExW
mov eax, dword [ebp - 0x28]
mov dword fs:[0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402428
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor esi, esi
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push edx
call sub.KERNEL32.DLL_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4024be
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov edi, eax
cmp edi, 0xffffffff
je 0x4024b8
cmp edi, 0x400
jbe 0x4024b8
mov eax, edi
push 0
sub eax, 0x400
push 0
push eax
push ebx
call sub.KERNEL32.DLL_SetFilePointer
xor edx, edx
lea ecx, [ebp - 8]
mov dword [ebp - 8], edx
push 0
push ecx
lea eax, [ebp - 0x24]
push 0x1c
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x4024b8
cmp dword [ebp - 8], 0x1c
jne 0x4024b8
cmp edi, dword [ebp - 0x20]
jne 0x4024b8
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 4]
jne 0x4024b8
lea eax, [ebp - 0x24]
call fcn.00402c74
test al, al
je 0x4024b8
mov esi, dword [ebp - 0x24]
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402754
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, 0x4109b0
call fcn.00401c00
test al, al
jne 0x40277c
call fcn.00401f08
call fcn.00401940
call fcn.004019e8
call fcn.00401940
xor ebx, ebx
mov eax, dword [esi + ebx*8]
call fcn.0040217c
push dword [esi + ebx*8]
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x4027a9
mov ecx, dword [esi + ebx*8]
mov edx, dword [ebx*4 + 0x40c3b0]
mov eax, dword [0x40c3c8]
call fcn.0040293c
jmp 0x4027bd
test ah, 0x40
je 0x4027bd
mov eax, dword [esi + ebx*8]
xor ecx, ecx
mov edx, 0xa0000000
call fcn.00401f74
inc ebx
cmp ebx, 4
jb 0x40277e
cmp dword [0x40c3c4], 3
je 0x402820
push 0
lea eax, [ebp - 4]
push 0
push eax
push 0
push str.Start
push dword [0x4109d8]
call sub.ADVAPI32.DLL_RegQueryValueExW
test eax, eax
jne 0x4027f0
cmp dword [ebp - 4], 4
je 0x402820
push dword [0x4109d8]
call sub.ADVAPI32.DLL_RegCloseKey
xor edx, edx
mov dword [0x4109d8], edx
call fcn.00402cc0
push 0x4109d8
push 1
push 0
push str.SYSTEMCurrentControlSetServicesLcss
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExW
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x402828
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, 0x40ccdc
call fcn.00404904
mov word [ebp - 0x18], 8
push 0
push 0
push 3
push 0
push 3
push 0x80000000
push ebx
call sub.KERNEL32.DLL_CreateFileW
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402929
push 2
push 0
push 0xfffffc00
push ebx
call sub.KERNEL32.DLL_SetFilePointer
xor edx, edx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], edx
push 0
push ecx
lea eax, [ebp - 0x48]
push 0x1c
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x48]
mov dword [edx + 0x1c], ecx
mov ecx, 8
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x34]
add eax, 0xc
call fcn.0040349e
mov ebx, dword [ebp - 0x38]
test ebx, ebx
jl 0x4028b8
cmp ebx, 2
jl 0x4028c3
mov eax, dword [ebp - 0x28]
mov dword fs:[0], eax
jmp 0x402929
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx + ebx*4 + 4], ecx
mov edx, dword [ebp + ebx*4 - 0x34]
mov ecx, dword [ebp + ebx*4 - 0x34]
xor eax, eax
cmp ebx, eax
jle 0x4028f4
mov esi, dword [ebp - 4]
mov dword [esi + eax*4 + 4], edx
add edx, dword [ebp + eax*4 - 0x34]
cmp ecx, dword [ebp + eax*4 - 0x34]
jae 0x4028ef
mov ecx, dword [ebp + eax*4 - 0x34]
inc eax
cmp ebx, eax
jg 0x4028da
lea eax, [ebx + 1]
mov word [ebp - 0x18], 8
cmp eax, 2
jge 0x40291d
mov ebx, dword [ebp - 4]
mov dword [ebx + eax*4 + 4], edx
add edx, dword [ebp + eax*4 - 0x34]
cmp ecx, dword [ebp + eax*4 - 0x34]
jae 0x402917
mov ecx, dword [ebp + eax*4 - 0x34]
inc eax
cmp eax, 2
jl 0x402902
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], edx
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402cc0
Capabilities:
Create service
Delete service
Persist via windows service
Set registry value
Start service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0xf003f
push 0
push 0
call sub.ADVAPI32.DLL_OpenSCManagerW
mov ebx, eax
test ebx, ebx
je 0x402d86
push 0xf01ff
push 0x40c2d8
push ebx
call sub.ADVAPI32.DLL_OpenServiceW
mov esi, eax
test esi, esi
je 0x402d00
push esi
call sub.ADVAPI32.DLL_DeleteService
push esi
call sub.ADVAPI32.DLL_CloseServiceHandle
push 0
push 0
push 0
push 0
push 0
push dword [0x4109c8]
push 0
push 2
push 0x10
push 0xf01ff
push 0x40cb6a
push 0x40c2d8
push ebx
call sub.ADVAPI32.DLL_CreateServiceW
mov esi, eax
test esi, esi
je 0x402d41
push 0
push 0
push esi
call sub.ADVAPI32.DLL_StartServiceW
push esi
call sub.ADVAPI32.DLL_CloseServiceHandle
push ebx
call sub.ADVAPI32.DLL_CloseServiceHandle
xor eax, eax
mov dword [ebp - 4], eax
lea edx, [ebp - 4]
push edx
push 2
push 0
push str.SYSTEMCurrentControlSetServicesLcss
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExW
push 0xa4
push 0x40c2e2
push 1
push 0
push str.Description
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegSetValueExW
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4041fc
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x4082a4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x408306
call fcn.00408254
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00404690
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00404690
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x408384
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x40f8a0], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x40845e
cmp dword [0x40f89c], 0
jne 0x40845e
cmp dword [0x40faa8], 0
je 0x408418
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.00408154
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4083fe
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.00408154
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4083fe
lea ebx, [ebp - 0x84]
jmp 0x4083ff
inc ebx
call fcn.00408340
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x408499
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x40f8a4
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00404690
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x40f8a7
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x408499
cmp dword [0x40f89c], 0
je 0x408478
cmp dword [0x40f89c], 0xffffffff
je 0x408499
push esi
call dword [0x40f89c]
pop ecx
mov eax, dword [0x40f8a0]
test eax, eax
je 0x408499
cmp dword [0x40f8a0], 0xffffffff
je 0x408499
cmp byte [eax], 0
je 0x408499
push esi
push eax
call fcn.004082a4
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431e40
Capabilities:
Hash data with md5

Disassembly:
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [esp + 0x14]
mov eax, dword [0x481ed8]
mov ecx, dword [0x48198c]
shl ecx, 5
neg ecx
lea eax, [eax + ecx + 0x1c02cf74]
cmp eax, 0xffdbfcfb
je 0x431e82
mov eax, dword [0x4812cc]
mov ecx, dword [0x481608]
and ecx, eax
and ecx, 0xfae3582f
mov dword [0x481608], ecx
mov eax, dword [0x4822d0]
xor eax, 0x1a4c0250
or dword [0x481484], eax
mov dword [esp], edi
call fcn.0044f730
mov ecx, dword [0x481584]
lea edx, [ecx - 1]
mov dword [0x481584], edx
mov edx, dword [0x4804ec]
imul edx, ecx
mov dword [0x4804ec], edx
mov ecx, dword [0x482df8]
or dword [0x481bf8], 0x297790f6
mov dword [esi], 0
mov ecx, dword [0x4807d4]
imul ecx, ecx, 0xe04bcf7b
mov dword [0x4807d4], ecx
mov dword [esi + 4], 0
mov dword [0x481eb0], 0x68e9179f
mov dword [esi + 8], 0x67452301
add dword [0x482e44], 0x1c7ae5b8
mov dword [esi + 0xc], 0xefcdab89
mov ecx, dword [0x481aa0]
add ecx, 0x45d29165
and dword [0x4818e0], ecx
mov dword [esi + 0x10], 0x98badcfe
mov ecx, dword [0x480430]
mov ecx, dword [0x480138]
lea edx, [ecx - 1]
mov dword [0x480138], edx
mov edx, dword [0x481150]
sar edx, 3
xor edx, 0xd6717b
cmp ecx, edx
jge 0x431f50
mov ecx, dword [0x482a90]
mov dword [esi + 0x14], 0x10325476
mov cx, word [0x4841ea]
lea edx, [ecx + 1]
mov word [0x4841ea], dx
movsx ecx, cx
mov edx, 0x1b20850a
sub edx, ecx
and dword [0x481d1c], edx
add dword [0x481da8], 0xf3095c0d
mov dword [esp + 4], eax
mov dword [esp], edi
mov ecx, esi
call fcn.004159e0
sub esp, 8
mov ax, word [0x483416]
add eax, 0x274b
mov word [0x483416], ax
mov ecx, esi
call fcn.00413060
mov eax, dword [0x480214]
or dword [0x482194], eax
mov ecx, esi
call fcn.004057e0
mov eax, dword [0x4804b4]
inc eax
mov dword [0x4804b4], eax
or eax, 0xecbd5a80
mov dword [0x480234], eax
add esi, 0xb9
mov eax, esi
add esp, 8
pop esi
pop edi
ret 4

Function at 0x432580
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 8
mov ax, word [0x483302]
add eax, 0xffffbfdf
mov word [0x483302], ax
mov eax, dword [0x484930]
xor dword [0x482bd8], 0x32a220
mov ecx, dword [0x4803fc]
lea edx, [ecx - 1]
mov dword [0x4803fc], edx
imul ecx, ecx, 0xfcbf20e
mov edx, dword [0x4803e4]
mov esi, dword [0x481d20]
xor esi, edx
xor esi, ecx
not esi
mov dword [0x481d20], esi
mov dword [esp], eax
mov dword [esp + 4], 0x4e20
call dword [0x480098]
sub esp, 8
mov cx, word [0x48440c]
imul ecx, ecx, 0x230c
mov word [0x48440c], cx
cmp eax, 0x80
je 0x432640
test eax, eax
jne 0x43265b
mov eax, dword [0x480e50]
lea ecx, [eax + 1]
mov dword [0x480e50], ecx
mov cx, word [0x483528]
lea edx, [ecx - 1]
mov word [0x483528], dx
movsx ecx, cx
neg ecx
lea eax, [eax + ecx + 0x4bb59c50]
mov ecx, dword [0x4825a4]
imul ecx, eax
mov dword [0x4825a4], ecx
jmp 0x43266b
mov ax, word [0x48462e]
dec eax
mov word [0x48462e], ax
cwde
xor eax, 0x8af0debf
or dword [0x48206c], eax
jmp 0x43266b
mov eax, dword [0x4805f0]
imul eax, eax, 0x6ff03c72
mov dword [0x4805f0], eax
mov eax, dword [0x481438]
lea ecx, [eax + 1]
mov dword [0x481438], ecx
add eax, 0x72c4d647
xor eax, 0x8622ea91
cmp eax, 0x93f731e0
jl 0x432690
mov ax, word [0x4845e0]
mov dword [esp], 1
call fcn.00453475
int3
Function at 0x437150
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [0x4837a8]
cwde
sar eax, 0xa
mov dword [0x480e80], eax
add dword [0x48226c], 0x61525d7
mov eax, dword [0x482794]
cmp eax, 0x40010100
jne 0x43718b
mov eax, dword [0x481cd0]
cmp eax, 0x1539e585
jg 0x43718b
add dword [0x4809e8], 0x6e34044
mov ax, word [0x4830c8]
add eax, 0xffffb7d6
mov word [0x4830c8], ax
mov eax, dword [0x482b18]
mov ecx, dword [0x482028]
or ecx, eax
or ecx, 0x59ef2092
cmp ecx, 0x7dfe0000
jl 0x4371bc
mov eax, dword [0x482e58]
push edi
push esi
sub esp, 0x14
lea eax, [esp + 4]
mov dword [esp], eax
call dword [0x480048]
sub esp, 4
mov eax, dword [0x482b78]
cmp eax, 0xedff6000
jl 0x4371e7
xor dword [0x481c74], 0x34698730
movzx eax, word [esp + 0x12]
mov ecx, dword [0x481c78]
xor ecx, 0xf630bec2
mov edx, dword [0x481860]
sub edx, ecx
mov dword [0x481860], edx
xor edi, edi
mov ecx, 0x15
nop
nop
nop
mov edx, dword [0x4813f8]
imul edx, edx, 0x78f46ea4
add edx, 0x466
mov si, word [0x4832a6]
xor esi, edx
mov word [0x4832a6], si
mov edx, dword [0x48058c]
shl edx, 8
mov dword [0x480f0c], edx
lea edi, [edi + eax*2]
add eax, eax
mov edx, dword [0x480b5c]
imul edx, edx, 0xd1a6a3df
mov dword [0x480b5c], edx
dec ecx
jne 0x437210
mov ax, word [0x484112]
lea ecx, [eax + 1]
mov word [0x484112], cx
cwde
add eax, 0x2ef5c38c
cmp eax, 0x1aea782d
jl 0x43728a
mov eax, dword [0x480bf4]
imul eax, eax, 0xb56e9519
mov dword [0x480bf4], eax
jmp 0x4372a1
mov eax, dword [0x480d44]
cmp eax, 0x6f0ce6dc
jne 0x4372a1
mov eax, dword [0x4815e4]
inc dword [0x482884]
mov dword [esp], 0
call fcn.00452d39
mov esi, eax
xor esi, edi
mov eax, dword [0x480198]
or eax, 0x7ad1f7fe
mov ecx, dword [0x4813b0]
imul ecx, eax
mov dword [0x4813b0], ecx
call dword [0x480008]
xor eax, esi
mov dword [0x482574], 0x9cf3ab6
mov dword [esp], eax
call fcn.004534aa
xor dword [0x4806d8], 0xf7fffee7
add esp, 0x14
pop esi
pop edi
ret

Function at 0x4423c0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov ecx, dword [esp + 0xc]
mov eax, dword [0x480fdc]
not eax
imul eax, eax, 0x307c4632
mov edx, dword [0x480af0]
not edx
cmp eax, edx
jge 0x4423e9
add dword [0x480fb4], 0xbacca600
mov eax, dword [0x481d58]
not eax
imul eax, eax, 0x41bf125c
or eax, 0x7138c48f
mov edx, dword [0x482834]
imul edx, eax
mov dword [0x482834], edx
test ecx, ecx
je 0x442477
mov eax, dword [0x481bb0]
mov dword [0x4825a4], 0x4b1727ce
mov eax, 0x1f
test ecx, ecx
js 0x442461
mov edx, 0x80000000
nop
nop
nop
nop
nop
mov si, word [0x483084]
movsx esi, si
sar esi, 5
mov edi, 0x3674aa94
sub edi, esi
xor edi, 0xe978bef
mov dword [0x48187c], edi
dec eax
add dword [0x482f88], 0x5dafd7fa
shr edx, 1
test edx, ecx
je 0x442430
mov cx, word [0x48432e]
add ecx, 0x3e7f
mov word [0x48432e], cx
jmp 0x44247b
mov eax, dword [esp + 0x10]
mov ecx, dword [0x482118]
add ecx, 0xad7931f1
or ecx, 0x177e76bb
cmp ecx, 0xb8ad7622
jg 0x4424ab
mov ecx, dword [0x4805dc]
mov edx, dword [0x482280]
add edx, edx
and edx, ecx
add dword [0x4823f4], edx
pop esi
pop edi
ret
Function at 0x45a558
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x47f040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00456ac1
mov dword [ebp - 0x14], eax
cmp dword [0x485b64], esi
jne 0x45a64b
push 0x800
push esi
push 0x471220
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x45a5d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x45a72b
push esi
push esi
push 0x471220
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x45a72b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45a72b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x485b64], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x485b68], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x485b6c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x485b74], eax
test eax, eax
je 0x45a648
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x485b70], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x45a670
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x45a663
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x45a685
push 4
pop eax
jmp 0x45a72d
cmp dword [ebp - 0x14], esi
je 0x45a685
push dword [0x485b64]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x45a66a
mov eax, dword [0x485b70]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x45a6e3
cmp dword [0x485b74], edi
je 0x45a6e3
push eax
call ebx
push dword [0x485b74]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x45a6e3
test eax, eax
je 0x45a6e3
call ecx
test eax, eax
je 0x45a6d8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x45a6d8
test byte [ebp - 8], 1
jne 0x45a6e3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x45a713
mov eax, dword [0x485b68]
cmp eax, edi
je 0x45a710
push eax
call ebx
test eax, eax
je 0x45a710
call eax
mov esi, eax
test esi, esi
je 0x45a710
mov eax, dword [0x485b6c]
cmp eax, edi
je 0x45a710
push eax
call ebx
test eax, eax
je 0x45a710
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x485b64]
call ebx
test eax, eax
je 0x45a72b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x45a72d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045a75c
mov esp, ebp
pop ebp
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10508
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
push esi
push 0x10352
mov dword [0x10a08], eax
mov eax, dword [ebp + 0xc]
push esi
push esi
mov dword [0x10a04], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [section..data], eax
push esi
lea eax, [ebp + 0xc]
push eax
mov dword [0x10a14], esi
call dword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
mov edi, dword [sym.imp.HAL.dll_KeGetCurrentIrql]
call edi
test al, al
je 0x10555
xor cl, cl
call dword [sym.imp.HAL.dll_KfRaiseIrql]
call edi
test al, al
je 0x1055f
xor eax, eax
jmp 0x10589
push esi
lea eax, [ebp + 8]
push eax
push esi
push esi
push 0x1f03ff
push dword [ebp + 0xc]
mov dword [ebp + 8], esi
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
push esi
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov eax, dword [0x10a14]
pop edi
pop esi
pop ebp
ret 0xc