joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422a20
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x88
push 0xffffffffffffffff
push 0x43fc4b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x451220]
xor eax, ebp
mov dword [ebp + 0x84], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [0x455590], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
mov ecx, 0x41
lea ebx, [ebp]
call fcn.00422760
add esp, 0xc
xor eax, eax
mov word [ebp + 0x80], ax
xor ebx, ebx
xor esi, esi
lea ecx, [ebp]
push ecx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, ebx
je 0x422b7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x422ac4
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], ebx
call fcn.004227d0
cmp eax, ebx
je 0x422ada
mov dword [0x455590], eax
jmp 0x422b5b
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp eax, ebx
je 0x422af5
push 0x5c0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 1
cmp esi, ebx
je 0x422b09
push edi
push esi
call fcn.00422ea0
jmp 0x422b0b
xor eax, eax
mov byte [ebp - 4], bl
mov dword [0x455590], eax
cmp eax, ebx
jne 0x422b2c
mov dword [ebp - 0x1c], 1
push 0x44ee18
lea edx, [ebp - 0x1c]
push edx
call fcn.00429dbb
mov esi, 1
mov dword [ebp - 0x24], esi
push eax
call fcn.004228c0
add esp, 4
test eax, eax
jne 0x422b56
mov dword [ebp - 0x18], 3
push 0x44ee18
lea eax, [ebp - 0x18]
push eax
call fcn.00429dbb
mov eax, dword [0x455590]
inc dword [eax + 0x5bc]
mov dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp esi, ebx
jne 0x422b7a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x455590
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x84]
xor ecx, ebp
call fcn.00427527
add ebp, 0x88
mov esp, ebp
pop ebp
ret
Function at 0x422c60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43fbf0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x451220]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ecx, dword [0x455590]
xor edi, edi
cmp ecx, edi
jne 0x422cab
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jne 0x422cb8
mov dword [ebp - 0x14], edi
jmp 0x422cd0
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x422d76
mov ecx, dword [0x455590]
mov eax, dword [ecx]
cmp eax, edi
je 0x422c97
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x422c97
mov dword [ebp - 4], edi
mov ebx, 0x455590
call fcn.00422d90
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, edi
jne 0x422d0e
mov dword [ebp - 0x18], 1
push 0x44ee18
lea eax, [ebp - 0x18]
push eax
call fcn.00429dbb
mov ecx, dword [0x455590]
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x422d28
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp eax, edi
jne 0x422d3d
mov dword [ebp - 0x1c], 4
push 0x44ee18
lea edx, [ebp - 0x1c]
push edx
call fcn.00429dbb
mov dword [ebp - 4], 0xffffffff
jmp 0x422d62
mov eax, dword [0x455590]
mov eax, dword [eax]
test eax, eax
je 0x422d74
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422d90
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x5b0]
add eax, 8
mov dword [eax + 0x5b0], ecx
cmp ecx, eax
jne 0x422dbd
xor ecx, ecx
jmp 0x422dc9
mov edx, dword [ecx + 0x5a8]
mov dword [eax + 0x5b0], edx
push esi
mov esi, ecx
test ecx, ecx
je 0x422e7d
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi]
cmp dword [esp + 0x10], eax
jne 0x422df0
mov dword [esp + 0xc], esi
jmp 0x422e50
push eax
push 1
push 0x40
call edi
test eax, eax
jne 0x422e49
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x422e3c
mov eax, dword [esi + 0x5ac]
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5a8], ecx
mov edx, dword [esi + 0x5a8]
mov eax, dword [esi + 0x5ac]
mov dword [edx + 0x5ac], eax
call ebp
test eax, eax
je 0x422e50
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x422e50
push 0x44dc68
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x422e50
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx]
mov esi, dword [eax + 0x5b8]
add eax, 8
cmp esi, eax
je 0x422e73
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5b0], ecx
test esi, esi
jne 0x422de2
mov eax, dword [esp + 0xc]
pop edi
pop ebp
test eax, eax
jne 0x422e91
mov ecx, dword [ebx]
add ecx, 8
call fcn.00423020
test eax, eax
je 0x422e91
mov edx, dword [esp + 8]
mov dword [eax], edx
pop esi
add esp, 8
ret

Function at 0x422ea0
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x43fbcb
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x451220]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
lea esi, [edi + 8]
push 0x5a0
lea eax, [esi + 8]
push 0
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
push eax
mov dword [esi], 0
call fcn.00429ac0
add esp, 0xc
mov dword [esi + 0x5ac], esi
mov dword [esi + 0x5a8], esi
mov dword [esi + 0x5b0], esi
mov dword [esp + 0x14], 0
mov dword [edi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
jne 0x422f38
push 0x44ee18
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 2
call fcn.00429dbb
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov dword [esp + 0x14], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x423c40
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
test ecx, ecx
je 0x423c6d
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
cmp eax, 0x90
je 0x423c6d
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx]
cmp edx, 0xcc
je 0x423c6d
xor eax, eax
jmp 0x423ca5
mov dword [ebp - 4], 1
jmp 0x423c7f
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x423ca0
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx]
cmp eax, edx
je 0x423c9e
xor eax, eax
jmp 0x423ca5
jmp 0x423c76
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x424fa0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1e8
mov eax, dword [0x451220]
xor eax, esp
mov dword [esp + 0x1e0], eax
mov eax, dword [ebx]
push ebp
push esi
xor esi, esi
push edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
cmp eax, 0xffffffff
je 0x42506d
push esi
push esi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x42506d
mov edx, dword [ebx]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea eax, [esp + 0x18]
push eax
push 0x118
lea ecx, [esp + 0x24]
push ecx
push edx
call ebp
test eax, eax
je 0x42506d
cmp dword [esp + 0x18], 0x54444851
jne 0x42506d
cmp dword [esp + 0x1c], 0x118
ja 0x42506d
mov edx, dword [ebx]
push 0
lea eax, [esp + 0x18]
push eax
lea edi, [ebx + 0xb8]
mov ecx, 0x46
lea esi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
push 0xb4
lea ecx, [esp + 0x13c]
push ecx
push edx
call ebp
test eax, eax
je 0x42506d
lea eax, [esp + 0x130]
push eax
mov ecx, ebx
call fcn.00425090
test eax, eax
je 0x42506d
mov edi, ebx
call fcn.00425160
test eax, eax
je 0x42506d
mov eax, 1
mov dword [ebx + 0x3dc], eax
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x1ec]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00427527
add esp, 0x1e8
ret

Function at 0x425090
Capabilities:
Get file size

Disassembly:
sub esp, 0xc0
mov eax, dword [0x451220]
xor eax, esp
mov dword [esp + 0xbc], eax
mov eax, dword [esp + 0xc4]
push ebx
push esi
push edi
mov esi, ecx
mov ecx, dword [esi + 0x3e0]
push eax
lea edi, [esp + 0x14]
lea ebx, [esp + 0x18]
mov dword [esp + 0x14], 0
call fcn.00425790
add esp, 4
cmp dword [esp + 0x10], 0x74
jne 0x42513b
lea ecx, [esp + 0x24]
push str.www.360.cn
push ecx
call fcn.004281ba
add esp, 8
test eax, eax
jne 0x42513b
lea edx, [esp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [esi]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x42513b
cmp dword [esp + 0xc], 0
jne 0x42513b
cmp eax, dword [esp + 0x74]
jne 0x42513b
lea ecx, [esi + 0x1d0]
push ecx
lea edx, [esp + 0x58]
push edx
call fcn.004281ba
add esp, 8
test eax, eax
jne 0x42513b
lea edi, [esi + 4]
mov ecx, 0x2d
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, 1
jmp 0x42513d
xor eax, eax
mov ecx, dword [esp + 0xc8]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00427527
add esp, 0xc0
ret 4
Function at 0x425160
Capabilities:
Get file size
Hash data with md5
Read file on windows

Disassembly:
sub esp, 0x80
mov eax, dword [0x451220]
xor eax, esp
mov dword [esp + 0x78], eax
mov eax, dword [edi]
push ebx
push ebp
xor ebp, ebp
xor ebx, ebx
push esi
mov dword [esp + 0xc], ebp
mov dword [esp + 0x14], ebp
cmp eax, 0xffffffff
je 0x4252c0
push ebp
push ebp
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4252c0
mov ecx, dword [edi]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x4252c0
cmp dword [esp + 0xc], ebp
jne 0x4252c0
push esi
call fcn.004273c8
mov ebx, eax
add esp, 4
cmp ebx, ebp
je 0x4252a9
mov eax, dword [edi]
push ebp
lea edx, [esp + 0x18]
push edx
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x425287
push 0xb4
lea ecx, [ebx + 0x118]
push ebp
push ecx
call fcn.00429ac0
push ebx
mov eax, esi
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x28], 0x67452301
mov dword [esp + 0x2c], 0xefcdab89
mov dword [esp + 0x30], 0x98badcfe
mov dword [esp + 0x34], 0x10325476
call fcn.00421180
add esp, 0x10
lea esi, [esp + 0x18]
lea ecx, [esp + 0x74]
call fcn.00426070
lea eax, [edi + 4]
lea edx, [esp + 0x74]
lea ecx, [ebp + 0x10]
sub edx, eax
nop
mov esi, dword [edx + eax]
cmp esi, dword [eax]
jne 0x425287
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x425250
push ebx
mov esi, 1
call fcn.004278ad
add esp, 4
mov eax, esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.00427527
add esp, 0x80
ret
push ebx
mov esi, ebp
call fcn.004278ad
add esp, 4
mov eax, esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.00427527
add esp, 0x80
ret
mov eax, ebp
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.00427527
add esp, 0x80
ret
mov ecx, dword [esp + 0x84]
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00427527
add esp, 0x80
ret
Function at 0x4252e0
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
sub esp, 0x134
mov eax, dword [0x451220]
xor eax, esp
mov dword [esp + 0x130], eax
mov eax, dword [esp + 0x138]
push ebx
push ebp
push edi
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x3d8]
xor edi, edi
cmp eax, edi
jne 0x4254fe
mov al, 0x6d
mov byte [esp + 0x128], al
mov byte [esp + 0x135], al
mov byte [esp + 0x13b], al
mov eax, dword [esi]
mov bl, 0xb1
mov dl, 0x68
mov cl, 0x8d
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], edi
mov byte [esp + 0x11c], 0x3a
mov byte [esp + 0x11d], 0x48
mov byte [esp + 0x11e], 0x6b
mov byte [esp + 0x11f], 0xa2
mov byte [esp + 0x120], 0x57
mov byte [esp + 0x121], 0x27
mov byte [esp + 0x122], bl
mov byte [esp + 0x123], 0x80
mov byte [esp + 0x124], 0xd
mov byte [esp + 0x125], 0x50
mov byte [esp + 0x126], dl
mov byte [esp + 0x127], cl
mov byte [esp + 0x129], 0x72
mov byte [esp + 0x12a], 0xb
mov byte [esp + 0x12b], 0xe2
mov byte [esp + 0x12c], 0xc6
mov byte [esp + 0x12d], 0x78
mov byte [esp + 0x12e], 0xff
mov byte [esp + 0x12f], 0x31
mov byte [esp + 0x130], 0x22
mov byte [esp + 0x131], 0xcb
mov byte [esp + 0x132], 0x44
mov byte [esp + 0x133], 0x63
mov byte [esp + 0x134], bl
mov byte [esp + 0x136], 0x1b
mov byte [esp + 0x137], 0x95
mov byte [esp + 0x138], 0xf5
mov byte [esp + 0x139], dl
mov byte [esp + 0x13a], cl
cmp eax, 0xffffffff
je 0x4254fc
cmp dword [esi + 0x3dc], edi
je 0x4254fc
push edi
push edi
push 0x1cc
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4254fc
mov ecx, dword [esi + 0x68]
push ecx
call fcn.004273c8
mov edx, dword [esi + 0x68]
add edx, 0x20
add esp, 4
push edx
mov ebp, eax
call fcn.004273c8
mov edx, dword [esi + 0x64]
add esp, 4
push edi
lea ecx, [esp + 0x1c]
push ecx
sub edx, 0x1cc
push edx
push eax
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4254e0
lea ebx, [esp + 0x20]
lea eax, [esp + 0x11c]
call fcn.00426310
mov edx, dword [esi + 0x68]
mov ecx, ebx
push ecx
mov ecx, dword [esp + 0x10]
push edx
lea edi, [esp + 0x134]
mov edx, ebp
call fcn.00426b10
mov eax, dword [esi + 0x68]
add esp, 8
push eax
push ebp
lea edi, [esp + 0x18]
call fcn.00425590
test eax, eax
je 0x4254e0
mov dword [esi + 0x3d8], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4254e0
mov ecx, dword [esp + 0x10]
mov dword [eax], ecx
mov edx, dword [esp + 0xc]
push edx
call fcn.004278ad
add esp, 4
push ebp
call fcn.004278ad
mov eax, dword [esp + 0x18]
add esp, 4
jmp 0x4254fe
xor eax, eax
mov ecx, dword [esp + 0x13c]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00427527
add esp, 0x134
ret 4
Function at 0x426150
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
test eax, eax
je 0x4262fe
test edx, edx
je 0x4262fe
movzx ecx, byte [eax]
push esi
movzx esi, byte [eax + 1]
push edi
movzx edi, byte [eax + 5]
shl ecx, 8
xor ecx, esi
movzx esi, byte [eax + 2]
shl ecx, 8
xor ecx, esi
movzx esi, byte [eax + 3]
shl ecx, 8
xor ecx, esi
movzx esi, byte [eax + 4]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 6]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 7]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 9]
mov dword [edx + 4], esi
movzx esi, byte [eax + 8]
mov dword [edx], ecx
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 0xa]
lea ecx, [edx + 4]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 0xb]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 0xd]
mov dword [edx + 8], esi
movzx esi, byte [eax + 0xc]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl esi, 8
xor esi, edi
shl esi, 8
xor esi, eax
mov dword [edx + 0xc], esi
mov dword [edx + 0xf0], 0xa
mov eax, esi
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x449da8]
xor eax, 0x1000000
mov edi, esi
shr edi, 8
and edi, 0xff
mov edi, dword [edi*4 + 0x44a1a8]
and edi, 0xff0000
and eax, 0xff000000
xor eax, edi
mov edi, esi
shr edi, 0x18
movzx edi, byte [edi*4 + 0x4499a8]
xor eax, edi
mov edi, esi
and edi, 0xff
mov edi, dword [edi*4 + 0x4495a8]
and edi, 0xff00
xor eax, edi
xor eax, dword [edx]
mov edi, dword [ecx]
xor edi, eax
mov dword [edx + 0x10], eax
mov eax, dword [edx + 8]
xor eax, edi
mov dword [edx + 0x18], eax
xor eax, esi
mov dword [edx + 0x14], edi
mov dword [edx + 0x1c], eax
mov esi, 0x44b6ac
mov edi, edi
mov edx, dword [ecx + 0x18]
add ecx, 0x10
mov eax, edx
shr eax, 8
mov edi, edx
and eax, 0xff
mov eax, dword [eax*4 + 0x44a1a8]
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x449da8]
and eax, 0xff0000
and edi, 0xff000000
xor eax, edi
mov edi, edx
and edx, 0xff
mov edx, dword [edx*4 + 0x4495a8]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x4499a8]
xor eax, edi
and edx, 0xff00
xor eax, edx
xor eax, dword [ecx - 4]
add esi, 4
xor eax, dword [esi - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ecx]
xor edx, eax
mov dword [ecx + 0x10], edx
mov eax, dword [ecx + 4]
xor eax, edx
mov dword [ecx + 0x14], eax
mov edx, dword [ecx + 8]
xor edx, eax
mov dword [ecx + 0x18], edx
cmp esi, 0x44b6d0
jne 0x426270
pop edi
xor eax, eax
pop esi
ret
or eax, 0xffffffff
ret
Function at 0x426310
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov edx, ebx
call fcn.00426150
test eax, eax
jl 0x426548
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
push edi
test edx, edx
jle 0x42637d
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea esp, [esp]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x426340
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x426544
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x4499a8]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x4499a8]
and esi, 0xff
mov esi, dword [esi*4 + 0x44a5a8]
and edi, 0xff
xor esi, dword [edi*4 + 0x44ada8]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4499a8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x44b1a8]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x4499a8]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x44a9a8]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x4499a8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x4499a8]
and esi, 0xff
mov esi, dword [esi*4 + 0x44a5a8]
and edi, 0xff
xor esi, dword [edi*4 + 0x44ada8]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x4499a8]
and edi, 0xff
xor esi, dword [edi*4 + 0x44a9a8]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4499a8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x44b1a8]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x4499a8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x4499a8]
and esi, 0xff
mov esi, dword [esi*4 + 0x44a5a8]
and edi, 0xff
xor esi, dword [edi*4 + 0x44ada8]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x4499a8]
and edi, 0xff
xor esi, dword [edi*4 + 0x44a9a8]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4499a8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x44b1a8]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x4499a8]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x4499a8]
and esi, 0xff
mov esi, dword [esi*4 + 0x44a5a8]
and edi, 0xff
xor esi, dword [edi*4 + 0x44ada8]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x4499a8]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4499a8]
and edi, 0xff
xor esi, dword [edi*4 + 0x44a9a8]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x44b1a8]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x426391
pop edi
xor eax, eax
pop esi
ret
Function at 0x427527
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x451220]
jne 0x427531
repz ret
jmp fcn.0042a36f

Function at 0x435c2f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042e3ba
and dword [ebp - 4], 0
cmp dword [0x45475c], 0
mov ebx, eax
jne 0x435ce0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x435d91
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x435d91
push eax
call fcn.0042e348
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x45475c], eax
call esi
push eax
call fcn.0042e348
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x454760], eax
call esi
push eax
call fcn.0042e348
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x454764], eax
call esi
push eax
call fcn.0042e348
pop ecx
mov dword [0x45476c], eax
test eax, eax
je 0x435ce0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042e348
pop ecx
mov dword [0x454768], eax
mov eax, dword [0x454768]
cmp eax, ebx
je 0x435d38
cmp dword [0x45476c], ebx
je 0x435d38
push eax
call fcn.0042e3c3
push dword [0x45476c]
mov esi, eax
call fcn.0042e3c3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x435d38
test edi, edi
je 0x435d38
call esi
test eax, eax
je 0x435d2f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x435d2f
test byte [ebp - 0xc], 1
jne 0x435d38
or dword [ebp + 0x10], 0x200000
jmp 0x435d71
mov eax, dword [0x454760]
cmp eax, ebx
je 0x435d71
push eax
call fcn.0042e3c3
pop ecx
test eax, eax
je 0x435d71
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x435d71
mov eax, dword [0x454764]
cmp eax, ebx
je 0x435d71
push eax
call fcn.0042e3c3
pop ecx
test eax, eax
je 0x435d71
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45475c]
call fcn.0042e3c3
pop ecx
test eax, eax
je 0x435d91
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x435d93
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43b2d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [edi + 0x2c]
push ebp
push esi
mov ebp, dword [edi + 0x3c]
sub ebp, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea edx, [ebx + ecx - 0x106]
sub ebp, eax
cmp eax, edx
jb 0x43b34e
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.0042a480
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x43b321
sub eax, ebx
jmp 0x43b323
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x43b312
mov ecx, dword [edi + 0x40]
mov edx, ebx
lea ecx, [ecx + ebx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x43b342
sub eax, ebx
jmp 0x43b344
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x43b333
add ebp, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x43b3a9
mov edx, dword [edi + 0x74]
add edx, dword [edi + 0x6c]
mov ecx, ebp
add edx, dword [edi + 0x38]
push edx
call fcn.0043b060
add dword [edi + 0x74], eax
mov edx, dword [edi + 0x74]
add esp, 4
cmp edx, 3
jb 0x43b395
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp edx, 0x106
jae 0x43b3a9
mov edx, dword [edi]
cmp dword [edx + 4], 0
jne 0x43b2d6
pop esi
pop ebp
pop ebx
ret

Function at 0x43d5ae
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
push esi
mov eax, dword [ecx + 0x3c]
push edi
mov eax, dword [eax + ecx + 0x78]
mov edx, dword [eax + ecx + 0x1c]
mov ebx, dword [eax + ecx + 0x20]
add edx, ecx
mov ebp, dword [eax + ecx + 0x24]
add ebx, ecx
mov dword [esp + 0x10], edx
add ebp, ecx
mov edx, dword [ebx]
xor eax, eax
add edx, ecx
cmp byte [edx], al
je 0x43d5e5
inc eax
cmp byte [eax + edx], 0
jne 0x43d5de
xor esi, esi
xor edi, edi
test eax, eax
je 0x43d606
nop
movsx cx, byte [edi + edx]
inc edi
imul esi, dword [esp + 0x20]
movzx ecx, cx
add esi, ecx
cmp edi, eax
jb 0x43d5ee
mov ecx, dword [esp + 0x18]
movzx eax, word [ebp]
mov edx, dword [esp + 0x10]
mov eax, dword [edx + eax*4]
add eax, ecx
cmp dword [esp + 0x1c], esi
je 0x43d621
add ebx, 4
add ebp, 2
invalid