joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x401443
pop dword [ebp - 0xc]
mov eax, 0x87ea72e3
sub eax, 0x87aa5ea0
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xa0bd2502
add dword [ebp - 0x1c], 0xad952049
mov dword [ebp - 0x18], 0x114f4d0
add dword [ebp - 0x18], 0x311e5775
mov dword [ebp - 0x14], 0x7bdd73ff
sub dword [ebp - 0x14], 0x2f912fd1
mov dword [ebp - 0x10], 0xe05c5daa
add dword [ebp - 0x10], 0x1fa3a256
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x31ab4012
sub dword [ebp - 0x1c], 0xbd38d6bc
mov dword [ebp - 0x18], 0x48b3cfed
add dword [ebp - 0x18], 0xf8b89188
mov dword [ebp - 0x14], 0x323c42bb
add dword [ebp - 0x14], 0x313329b1
mov dword [ebp - 0x10], 0x4ef8b996
add dword [ebp - 0x10], 0xb107466a
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3f2e9
push 0
call eax
mov ecx, 0x6339
mov edx, eax
mov ebx, 0xf0c487ed
add ebx, 0xf810a13
add ebx, dword [ebp - 0xc]
mov esi, 0xb15e24f3
sub esi, 0xf46f0e18
add dword [ebp - 8], edi
mov edi, dword [ebx]
xor dword [ebp - 4], 0x9adfb1c3
xor edi, esi
add dword [ebp - 4], esi
mov dword [edx], edi
sub dword [ebp - 4], 0x66266580
add edx, 0xfdf5d11c
add edx, 0x20a2ee8
add ebx, 0x4cf4a761
sub ebx, 0x4cf4a75d
loop 0x401555
add eax, 0xcd156626
sub eax, 0xcd13e66f
mov ebx, eax
add eax, 0x427b71a9
add eax, 0xbd848e5c
mov ecx, 0xc6cbe87
add ecx, 0xf3d34179
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x405b23
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405dee
test bl, 8
mov dword [ebp - 8], eax
je 0x405b62
push edi
call dword [sym.imp.kernel32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x434fa8], eax
jmp 0x405cdf
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405b7c
test eax, eax
je 0x405c8d
test bl, 2
je 0x405c8d
mov esi, 0x42f270
push edi
push esi
call fcn.00406411
cmp dword [ebp + 8], 0
je 0x405b9b
push 0x40a56c
push esi
call sub.kernel32.dll_lstrcatW
jmp 0x405ba1
push edi
call fcn.00405d32
cmp word [edi], 0
jne 0x405bb1
cmp word [0x42f270], 0x5c
jne 0x405bbc
push 0x40a014
push edi
call sub.kernel32.dll_lstrcatW
push edi
call sub.kernel32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405c82
cmp word [ebp - 0x22c], 0x2e
jne 0x405c06
cmp word [ebp - 0x22a], 0
je 0x405c65
cmp word [ebp - 0x22a], 0x2e
jne 0x405c06
cmp word [ebp - 0x228], 0
je 0x405c65
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.00406411
test byte [ebp - 0x258], 0x10
je 0x405c31
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405c65
push dword [ebp + 0xc]
push edi
call fcn.00401434
jmp 0x405c65
push dword [ebp - 4]
push edi
call fcn.00405adb
test eax, eax
jne 0x405c5d
cmp dword [ebp - 4], eax
je 0x405c55
push edi
push 0xfffffffffffffff1
call fcn.00401434
push 0
push edi
call fcn.004061d7
jmp 0x405c65
inc dword [0x434fa8]
jmp 0x405c65
push edi
push 0xfffffffffffffff2
call fcn.00401434
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x405bde
push esi
call dword [sym.imp.kernel32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405c8d
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405cdf
cmp dword [ebp - 8], esi
jne 0x405ca1
inc dword [0x434fa8]
jmp 0x405cdf
push edi
call fcn.0040676f
test eax, eax
je 0x405cdf
push edi
call fcn.00405ce6
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405adb
test eax, eax
jne 0x405cd7
cmp dword [ebp - 4], esi
je 0x405c99
push edi
push 0xfffffffffffffff1
call fcn.00401434
push esi
push edi
call fcn.004061d7
jmp 0x405cdf
push edi
push 0xffffffffffffffe5
call fcn.00401434
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4287df
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
cmp dword [0x45aa24], 0
je 0x428816
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call main
add esp, 4
jmp 0x42882f
call main
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call main
add esp, 4
jmp 0x42882f
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x431e0f
pop dword [ebp - 0x30]
mov eax, 0x2a0f245
sub eax, 0x25dd436
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x49aab
push 0
mov eax, 0xc747e415
add eax, 0x38fe83c3
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0xb70acad1
sub ecx, 0xb70a9349
xor edx, edx
add edx, eax
mov ebx, 0x25ac88d4
sub ebx, 0x2563a8d4
add ebx, dword [ebp - 0x30]
mov esi, 0xecdff8e5
add esi, 0xbf971362
sub dword [ebp - 0x14], ebx
mov edi, dword [ebx]
xor dword [ebp - 4], esi
sub edi, esi
xor dword [ebp - 4], 0xc8775b16
mov dword [edx], edi
sub dword [ebp - 0x24], ecx
add edx, 0x701f36f7
sub edx, 0x701f36f3
add ebx, 0x93c356b1
sub ebx, 0x93c356ad
loop 0x431e70
add eax, 0xe0c563f3
add eax, 0x1f3b6d00
xor ebx, ebx
add ebx, eax
add eax, 0xa28248a5
add eax, 0x5d7db760
mov ecx, 0xea2f7f41
add ecx, 0x161080bf
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x44c8c0
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.kernel32.dll_MoveFileA]
test eax, eax
mov eax, 0
jne 0x44c8df
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
je 0x44c8f2
push eax
call fcn.0044d700
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0xc915af4
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x233a1f1e
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x402733
Capabilities:
Terminate process

Disassembly:
call section..text
push 0
push 0x405018
push 0x405014
call fcn.00402c5f
push 0
push 0x405020
push 0x40501c
call fcn.00402c5f
add esp, 0x18
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x403106
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x405764]
test eax, eax
je 0x40311f
call eax
test eax, eax
jne 0x40311f
push 0xfffffffffffffffe
jmp 0x403139
push 1
push 0x405010
push 0x405008
call fcn.00402c5f
add esp, 0xc
test eax, eax
je 0x40313f
push 0xfffffffffffffffd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push 0
push 0x405004
push section..data
call fcn.00402c5f
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
test esi, esi
jne 0x403165
mov esi, 0x4045b1
mov cl, 0x20
jmp 0x40316e
cmp al, 0x20
ja 0x403178
inc esi
mov al, byte [esi]
test al, al
jne 0x403169
cmp al, 0x20
jbe 0x40318f
mov al, byte [esi]
cmp al, 0x22
jne 0x403181
xor cl, 0x20
inc esi
mov al, byte [esi]
cmp al, cl
ja 0x40317a
jmp 0x40318f
cmp al, cl
ja 0x403195
inc esi
mov al, byte [esi]
test al, al
jne 0x40318a
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test eax, 0xa0d0a0d
sub eax, 0x54524357
sub eax, 0xa0d0a0d
test byte [ebp - 0x18], 1
je 0x4031be
movzx eax, word [ebp - 0x14]
jmp 0x4031c1
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.00402733
pop ecx
pop esi
leave
ret

Function at 0x4031f8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40517f], eax
push 0
push dword [ebp + 8]
push 0
push 0
push 0
push 0x80000000
push 0xfffffc18
push 0xfffffc18
push 0xcf0000
push 0x4055c0
push 0x405628
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403242
xor eax, eax
jmp 0x403259
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
inc eax
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x2d3a565d
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0xc5c62c8
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x40ab38
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x8215f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040791f
and dword [ebp - 0x14], 0
cmp dword [0x822f18], 0
mov dword [ebp - 0x18], eax
jne 0x40abeb
push 0x40248c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40ac93
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402480
push ebx
call edi
test eax, eax
je 0x40ac93
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402470
push ebx
mov dword [0x822f18], eax
call edi
push eax
call esi
push 0x40245c
push ebx
mov dword [0x822f1c], eax
call edi
push eax
call esi
push 0x402440
push ebx
mov dword [0x822f20], eax
call edi
push eax
call esi
mov dword [0x822f28], eax
test eax, eax
je 0x40abeb
push 0x402428
push ebx
call edi
push eax
call esi
mov dword [0x822f24], eax
mov eax, dword [0x822f24]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40ac44
cmp dword [0x822f28], ecx
je 0x40ac44
push eax
call esi
push dword [0x822f28]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40ac44
test ebx, ebx
je 0x40ac44
call edi
test eax, eax
je 0x40ac3b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40ac3b
test byte [ebp - 8], 1
jne 0x40ac44
or dword [ebp + 0x10], 0x200000
jmp 0x40ac77
mov eax, dword [0x822f1c]
cmp eax, dword [ebp - 0x18]
je 0x40ac77
push eax
call esi
test eax, eax
je 0x40ac77
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40ac77
mov eax, dword [0x822f20]
cmp eax, dword [ebp - 0x18]
je 0x40ac77
push eax
call esi
test eax, eax
je 0x40ac77
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x822f18]
call esi
test eax, eax
je 0x40ac93
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40ac95
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040aea3
leave
ret

Function at 0x40aea3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x8215f8]
jne 0x40aead
repz ret
jmp fcn.0040dcf5
Function at 0x808ad0
Capabilities:
Accept command line arguments
Delete directory
Get common file path

Disassembly:
mov eax, 0x1420
call fcn.0040e0a0
cmp dword [0x265615c], 0x37
jne 0x808b87
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x403478
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
lea eax, [esp + 0x824]
push eax
push 0x403490
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 4]
push edx
push 0
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
lea edx, [esp + 0xc20]
push edx
push 0
push 0x4034e8
push 0x403500
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0x4035a0
push 0x403648
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
mov eax, dword [0x265b38c]
mov dword [esp], eax
mov eax, 0x5d1
add dword [esp], eax
mov ecx, dword [esp]
mov dl, byte [ecx + esi]
mov eax, dword [0x2656154]
mov byte [eax + esi], dl
add esp, 0x1420
ret

Function at 0x808bb0
Capabilities:
Manipulate console buffer

Disassembly:
sub esp, 0x64
mov edx, dword [str._fi]
mov ecx, dword [esp + 0x68]
mov eax, dword [ecx]
push ebx
mov ebx, dword [str.hip2_]
push ebp
mov ebp, dword [0x822364]
push esi
mov esi, dword [ecx + 4]
mov dword [esp + 0x1c], edx
mov edx, dword [0x82235c]
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0xc6ef3720
mov dword [esp + 0x28], 0x9e3779b9
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], 0x20
jmp 0x808c04
mov eax, dword [esp + 0x18]
mov edx, eax
mov edi, eax
shr edx, 5
shl edi, 4
add edi, ebx
add edx, ebp
xor edx, edi
mov edi, dword [esp + 0x10]
add edi, eax
xor edx, edi
sub esi, edx
mov eax, esi
shl eax, 4
mov dword [0x2656158], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
add dword [esp + 0x14], eax
mov edi, dword [esp + 0x10]
add edi, esi
cmp dword [0x265615c], 0x1be
jne 0x808c60
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov ecx, dword [esp + 0x78]
mov edx, esi
shr edx, 5
add edx, dword [esp + 0x24]
mov dword [0x2656160], 0xff6b3619
xor edx, edi
xor dword [esp + 0x14], edx
mov dword [0x2656164], 0xffffffff
mov eax, dword [esp + 0x14]
sub dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
sub dword [esp + 0x10], eax
dec dword [esp + 0x1c]
jne 0x808c00
cmp dword [0x265615c], 0x8d4
jne 0x808ccb
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x18]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
add esp, 0x64
ret 4
mov edx, dword [esp + 0x18]
pop edi
mov dword [ecx + 4], esi
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
add esp, 0x64
ret 4
Function at 0x401d25
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x1a4]
sub esp, 0x224
mov eax, dword [0x412320]
xor eax, ebp
mov dword [ebp + 0x1a0], eax
mov eax, dword [ebp + 0x1ac]
push ebx
push esi
mov esi, dword [ebp + 0x1b0]
push 0x104
lea ecx, [ebp - 0x68]
push ecx
push 0xffffffffffffffff
push eax
xor ebx, ebx
push ebx
push 0xfde9
mov dword [ebp - 0x6c], 0xfffffffd
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
test eax, eax
je 0x401e01
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x68]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x78], eax
cmp eax, ebx
je 0x401e01
push edi
mov edi, dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
push ebx
call edi
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x70], eax
cmp eax, ebx
je 0x401e00
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x68]
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x401df3
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x40e484
push dword [ebp - 0x70]
mov dword [ebp - 0x74], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x401df3
mov eax, dword [ebp - 0x7c]
movzx ecx, word [eax + 0xa]
mov dword [esi], ecx
movzx ecx, word [eax + 8]
mov dword [esi + 4], ecx
movzx ecx, word [eax + 0xe]
mov dword [esi + 8], ecx
movzx eax, word [eax + 0xc]
mov dword [esi + 0xc], eax
mov dword [ebp - 0x6c], ebx
push dword [ebp - 0x70]
push ebx
call edi
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
pop edi
mov ecx, dword [ebp + 0x1a0]
mov eax, dword [ebp - 0x6c]
pop esi
xor ecx, ebp
pop ebx
call fcn.004024bc
add ebp, 0x1a4
leave
ret

Function at 0x4024bc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412320]
jne 0x4024c6
repz ret
jmp fcn.00403ae7

Function at 0x40269e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x4026ad
pop dword [ebp - 0x44]
mov eax, 0x77266c1b
sub eax, 0x76e6456e
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x38c49
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x4446
xor edi, edi
add edi, eax
mov ebx, 0x7bb5ebca
sub ebx, 0x7b7473ca
add ebx, dword [ebp - 0x44]
mov esi, 0xd0b7b970
xor dword [ebp - 0x18], 0x259d1c4f
mov edx, dword [ebx]
add dword [ebp - 0x2c], 0xf6276d02
add edx, esi
mov dword [edi], edx
mov dword [ebp - 0x2c], 0x9bf9d048
add edi, 4
add ebx, 4
loop 0x4026fd
add eax, 0x103eb
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x16676166
sub ecx, 0x16276166
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x404cec
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406dfb
and dword [ebp - 4], 0
cmp dword [0x4134c8], 0
mov ebx, eax
jne 0x404d9d
push 0x40e914
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x404e4e
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxW
push edi
call esi
test eax, eax
je 0x404e4e
push eax
call main
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4134c8], eax
call esi
push eax
call main
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4134cc], eax
call esi
push eax
call main
mov dword [esp], str.GetUserObjectInformationW
push edi
mov dword [0x4134d0], eax
call esi
push eax
call main
pop ecx
mov dword [0x4134d8], eax
test eax, eax
je 0x404d9d
push str.GetProcessWindowStation
push edi
call esi
push eax
call main
pop ecx
mov dword [0x4134d4], eax
mov eax, dword [0x4134d4]
cmp eax, ebx
je 0x404df5
cmp dword [0x4134d8], ebx
je 0x404df5
push eax
call main
push dword [0x4134d8]
mov esi, eax
call main
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x404df5
test edi, edi
je 0x404df5
call esi
test eax, eax
je 0x404dec
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x404dec
test byte [ebp - 0xc], 1
jne 0x404df5
or dword [ebp + 0x10], 0x200000
jmp 0x404e2e
mov eax, dword [0x4134cc]
cmp eax, ebx
je 0x404e2e
push eax
call main
pop ecx
test eax, eax
je 0x404e2e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x404e2e
mov eax, dword [0x4134d0]
cmp eax, ebx
je 0x404e2e
push eax
call main
pop ecx
test eax, eax
je 0x404e2e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4134c8]
call main
pop ecx
test eax, eax
je 0x404e4e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x404e50
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x503e3063
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x5d33463f
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x41059c
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0x240
mov eax, 0x499edf
call fcn.0043525d
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x218]
push 0x208
xor ebx, ebx
push ebx
push eax
call fcn.00437ab0
add esp, 0xc
cmp dword [ebp + 8], 0xffffffff
je 0x4105dd
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
push ebx
invalid
invalid
mov al, 0x98
invalid
Function at 0x415a7f
Capabilities:
Set registry value

Disassembly:
push 0x34
mov eax, 0x49a8a8
call fcn.0043525d
push 8
lea esi, [ecx + 4]
pop edi
cmp dword [esi + 0x14], edi
jb 0x415a9a
mov eax, dword [esi]
jmp 0x415a9c
mov eax, esi
push 0xf003f
push eax
push reloc.WS2_32.dll_accept
lea ecx, [ebp - 0x40]
call fcn.00416cb6
and dword [ebp - 4], 0
push 0
call fcn.0043d16a
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov dword [esp], str.dGltZV91ZXQ
call fcn.00401aca
cmp dword [eax + 0x14], edi
jb 0x415ad6
mov eax, dword [eax]
lea ecx, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.00416e9e
mov ebx, eax
lea ecx, [ebp - 0x28]
push 0
neg ebx
push 1
sbb bl, bl
call fcn.004012eb
add bl, 1
je 0x415b0b
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x30]
cmp eax, 0x258
jge 0x415b0b
xor bl, bl
jmp 0x415b65
cmp dword [esi + 0x14], edi
jb 0x415b12
mov esi, dword [esi]
push 0x20006
push esi
push reloc.WS2_32.dll_accept
lea ecx, [ebp - 0x30]
call fcn.00416cb6
xor ebx, ebx
lea ecx, [ebp - 0x28]
inc ebx
push str.dGltZV91ZXQ
mov byte [ebp - 4], bl
call fcn.00401aca
cmp dword [eax + 0x14], edi
jb 0x415b3f
mov eax, dword [eax]
push edi
lea ecx, [ebp - 0x38]
push ecx
push 0xb
push 0
push eax
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0
push ebx
lea ecx, [ebp - 0x28]
call fcn.004012eb
lea ecx, [ebp - 0x30]
call fcn.00416da9
lea ecx, [ebp - 0x40]
call fcn.00416da9
mov al, bl
call fcn.00435207
ret