joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x42b01c]
push edi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push 0
call 0x1a803e9
nop
push eax
nop
call 0x77f1296e
mov ebx, eax
push 0x434fb0
mov dword [ebp - 4], ebx
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
mov byte [ebx + edi], 0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x404a9a
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 8], eax
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
mov ecx, dword [ebp + 0xc]
push ecx
add ebx, edi
nop
call 0x6ff643d3
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp + 0xc]
add esp, 4
push 0x434fb0
mov cl, byte [edx + eax]
mov edx, dword [ebp - 8]
xor cl, byte [edx + ebx]
mov byte [ebx], cl
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
mov ebx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x404a26
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
lea eax, [ebp - 0xc]
push eax
push 0x100
push 4
push ebx
mov dword [ebp - 0xc], 0
call 0x1a803ee
nop
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10013d6a
Capabilities:
Create directory
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x10023230]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
mov dword [ebp - 0x210], edi
cmp dword [0x10023688], edi
jne 0x10013d9a
mov eax, 0x80004005
jmp 0x10013ec7
push esi
lea eax, [ebp - 0x20c]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.api_ms_win_core_file_l1_2_0.dll_GetTempPathW]
test eax, eax
je 0x10013db6
cmp eax, esi
jbe 0x10013dd3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10013dcd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x10013ebd
push ebx
lea edx, [ebp - 0x210]
lea ecx, [ebp - 0x20c]
call fcn.1000ddd9
mov esi, eax
test esi, esi
js 0x10013eb6
mov edi, dword [ebp - 0x210]
push 0
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
mov ebx, 0xb7
test eax, eax
jne 0x10013e2a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, ebx
je 0x10013e2a
test eax, eax
jg 0x10013e19
mov esi, eax
jmp 0x10013e22
movzx esi, ax
or esi, 0x80070000
test esi, esi
js 0x10013ebc
push dword [0x10023680]
call sub.msvcrt.dll_free
pop ecx
mov dword [0x10023680], edi
lea eax, [ebp - 0x20c]
xor edi, edi
push eax
mov dword [ebp - 0x210], edi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x10013e86
push 0x1000add4
lea ecx, [ebp - 0x20c]
call fcn.1001209e
test eax, eax
js 0x10013e86
lea edx, [ebp - 0x210]
lea ecx, [ebp - 0x20c]
call fcn.10016268
mov esi, eax
test esi, esi
js 0x10013eb6
mov edi, dword [ebp - 0x210]
push 0
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateDirectoryW]
test eax, eax
jne 0x10013ea0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, ebx
je 0x10013ea0
xor esi, esi
inc esi
push dword [0x10023680]
call sub.msvcrt.dll_free
mov dword [0x10023680], edi
xor edi, edi
pop ecx
jmp 0x10013ebc
mov edi, dword [ebp - 0x210]
pop ebx
push edi
call sub.msvcrt.dll_free
pop ecx
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1001fd10
mov esp, ebp
pop ebp
ret
Function at 0x10020180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x100201be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x100201b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x100201c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x100201a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10020290
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x100202a6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x100202c1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x4086ef
Capabilities:
Parse pe header

Disassembly:
push 8
push 0x434540
call fcn.0041bd60
mov esi, ecx
and dword [ebp - 4], 0
lea edi, [esi + 0x28]
push dword [ebp + 0xc]
push 0x40
push 0
push edi
call dword [ebp + 8]
add esp, 0x10
test al, al
je 0x4087df
or dword [ebp - 4], 0xffffffff
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x4087ce
cmp dword [esi + 0x64], 0
je 0x4087ce
mov dword [ebp - 4], 1
lea edi, [esi + 0x68]
push dword [ebp + 0xc]
push 0xf8
push dword [esi + 0x64]
push edi
call dword [ebp + 8]
add esp, 0x10
test al, al
je 0x4087df
or dword [ebp - 4], 0xffffffff
cmp dword [edi], 0x4550
jne 0x4087ce
mov eax, 0x10b
cmp word [esi + 0x80], ax
jne 0x4087ce
movzx eax, word [esi + 0x6e]
test ax, ax
je 0x4087ce
mov edi, eax
imul edi, edi, 0x28
movzx ecx, word [esi + 0x7c]
mov ebx, dword [esi + 0x64]
add ecx, 0x18
add ebx, ecx
push edi
call fcn.0041e0fd
pop ecx
mov dword [esi + 0x160], eax
test eax, eax
jne 0x4087a3
push 8
jmp 0x4087e5
mov dword [ebp - 4], 2
push dword [ebp + 0xc]
push edi
push ebx
push eax
call dword [ebp + 8]
add esp, 0x10
test al, al
je 0x4087df
or dword [ebp - 4], 0xffffffff
lea eax, [ebx + edi]
mov dword [esi + 0x10], eax
xor eax, eax
jmp 0x4087e6
push 0xb
jmp 0x4087e5
or dword [ebp - 4], 0xffffffff
push 0x1e
pop eax
call fcn.0041bd9b
ret 8
Function at 0x40c106
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
not ecx
jmp 0x40c140
movzx eax, byte [edi]
movzx edx, cl
xor edx, eax
push 8
dec esi
inc edi
pop eax
test dl, 1
je 0x40c134
shr edx, 1
xor edx, 0xedb88320
jmp 0x40c136
shr edx, 1
dec eax
test eax, eax
jg 0x40c125
shr ecx, 8
xor ecx, edx
test esi, esi
jne 0x40c118
not ecx
pop edi
mov eax, ecx
pop esi
ret
Function at 0x40e7cb
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
shr ecx, 2
push esi
shr edx, 2
push edi
lea esi, [eax + ecx*4]
mov eax, dword [ebp + 0x14]
mov edi, 0xc0c0c0c0
test ecx, ecx
je 0x40e7fa
add eax, 0xb16b00b0
xor eax, edi
dec ecx
jne 0x40e7f0
test edx, edx
je 0x40e80d
xor dword [esi], eax
add eax, 0xb16b00b0
xor eax, edi
lea esi, [esi + 4]
dec edx
jne 0x40e7fe
pop edi
pop esi
pop ebp
ret
Function at 0x413bcd
Capabilities:
Get common file path

Disassembly:
push 0x318
push 0x434fb8
call fcn.0041bd60
or dword [ebp - 0x1c], 0xffffffff
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call fcn.00411ddc
pop ecx
mov dword [ebp - 0x1c], eax
or dword [ebp - 4], 0xffffffff
jmp 0x413c04
cmp byte [0x43ad1c], 0
je 0x413d34
mov byte [ebp - 0x328], bl
mov esi, 0x103
push esi
push ebx
lea eax, [ebp - 0x327]
push eax
call fcn.0041b420
add esp, 0xc
mov ecx, dword [0x4387c0]
lea eax, [ecx + 0xb4]
push eax
push 1
call fcn.0040dd5c
cmp dword [eax], ebx
je 0x413ca4
mov ecx, dword [0x4387c0]
lea eax, [ecx + 0xbc]
push eax
push 1
call fcn.0040dd5c
cmp dword [eax], ebx
je 0x413c78
mov ecx, dword [0x4387c0]
lea eax, [ecx + 0xbc]
push eax
push 1
call fcn.0040dd5c
push ebx
call dword [eax]
mov esi, eax
jmp 0x413c7a
mov esi, ebx
mov ecx, dword [0x4387c0]
lea eax, [ecx + 0xb4]
push eax
push 1
call fcn.0040dd5c
push 0x104
lea ecx, [ebp - 0x328]
push ecx
push esi
call dword [eax]
mov esi, 0x103
jmp 0x413ca6
mov eax, ebx
test eax, eax
je 0x413d34
mov byte [ebp - 0x120], bl
push esi
push ebx
lea eax, [ebp - 0x11f]
push eax
call fcn.0041b420
mov byte [ebp - 0x224], bl
push esi
push ebx
lea eax, [ebp - 0x223]
push eax
call fcn.0041b420
add esp, 0x18
lea eax, [ebp - 0x120]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x413d34
cmp eax, 0xf2
ja 0x413d34
lea eax, [ebp - 0x224]
push eax
push ebx
push 0x438e88
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x413d34
push 0x438e8c
lea eax, [ebp - 0x224]
push eax
call fcn.0041e630
lea eax, [ebp - 0x328]
push eax
call fcn.00411540
add esp, 0xc
mov eax, dword [ebp - 0x1c]
call fcn.0041bd9b
ret
Function at 0x41510d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x42989b
call fcn.0041bd3c
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esi + 0x10]
inc edi
cmp dword [esi + 0x14], 8
jb 0x41512c
mov eax, dword [esi]
jmp 0x41512e
mov eax, esi
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push edi
push eax
push ecx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
push ebp
call fcn.0041a976
pop ecx
mov dword [esp + 0x24], eax
xor eax, eax
mov dword [esp + 0x14], eax
cmp dword [esi + 0x14], 8
jb 0x41515d
mov esi, dword [esi]
push eax
push eax
push ebp
lea ecx, [esp + 0x30]
call fcn.0041847a
push eax
push edi
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [esp + 0x24]
call fcn.0041847a
mov esi, eax
push esi
call fcn.00406b76
pop ecx
mov ecx, dword [esp + 0x20]
push eax
push esi
call fcn.00406721
or dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.00415495
mov ecx, dword [esp + 0xc]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
leave
ret

Function at 0x415c77
Capabilities:
Check for vm using instruction vpcext
Reference the vmware io port

Disassembly:
push 0xc
push 0x435818
call fcn.0041bd60
mov dword [ebp - 0x1c], 0
and dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
xor ebx, ebx
mov ecx, 0x14
mov edx, 0x5658
in eax, dx
cmp eax, 0x20
jl 0x415cb7
cmp eax, 0x4000
jg 0x415cb7
mov eax, 1
or dword [ebp - 0x1c], eax
pop ebx
pop ecx
pop edx
jmp 0x415cc3
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 1
push ebx
xor eax, eax
xor ebx, ebx
inc eax
invalid

Function at 0x4166f3
Capabilities:
Delete directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [0x43ad40]
jmp 0x4167b6
cmp dword [esi + 0x14], 0x10
jb 0x416710
mov eax, dword [esi]
jmp 0x416712
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
call fcn.0041a1da
cmp eax, 2
jae 0x416734
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call fcn.0041a1da
cmp eax, 3
jae 0x41674d
push str.Local882
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call fcn.0041a1da
cmp eax, 2
jae 0x416772
push str.Local11583
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x416772
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.0041a1da
cmp eax, 2
jae 0x416798
push str.Local11584
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x416798
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.0041a1da
cmp eax, 2
jae 0x4167b3
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
add esi, 0x18
cmp esi, dword [0x43ad44]
jne 0x416706
pop esi
leave
ret
Function at 0x41a286
Capabilities:
Delete directory

Disassembly:
mov eax, 0x429ea6
call fcn.0041bd3c
sub esp, 0x1c
cmp dword [0x43ad3c], 0
je 0x41a443
push esi
mov ecx, 0x43ad2c
call fcn.00416601
push eax
lea ecx, [ebp - 0x28]
call fcn.0040f6d7
and dword [ebp - 4], 0
call fcn.0041a1da
cmp eax, 2
jae 0x41a2d9
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x41a2d9
push eax
mov byte [eax + 1], 0xd4
call fcn.0040c4f8
pop ecx
mov ecx, 0x43ad2c
call fcn.00419c69
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor ecx, ecx
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], cl
je 0x41a317
push ecx
push ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor ecx, ecx
call fcn.0041a1da
cmp eax, 3
jae 0x41a32e
push str.Local369
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
xor ecx, ecx
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], cl
je 0x41a365
mov esi, 0x307
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x307
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x41a33d
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x41a384
push ecx
push ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor ecx, ecx
call fcn.0041a1da
cmp eax, 3
jae 0x41a3aa
push str.Global463
push ecx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x41a3aa
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.0041a1da
cmp eax, 2
jae 0x41a3d0
push str.Local11694
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x41a3d0
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x41a408
mov esi, 0x290
jmp 0x41a3e3
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x290
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
dec esi
jne 0x41a3e1
call fcn.0041a1da
cmp eax, 2
jae 0x41a429
push 2
call fcn.0041a976
pop ecx
test eax, eax
je 0x41a429
push eax
mov byte [eax + 1], 0xe4
call fcn.0040c4f8
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040165f
cmp dword [0x43ad3c], 0
jne 0x41a2a1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x41a44f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x429e4b
call fcn.0041bd3c
sub esp, 0x20
push ebx
push edi
mov edi, ecx
call fcn.0041a1da
cmp eax, 2
jae 0x41a480
push str.545545
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x41a480
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor ebx, ebx
mov byte [esp + 0xb], bl
cmp byte [esp + 0xb], bl
je 0x41a4b6
push ebp
mov ebp, 0x1ac
push esi
mov esi, ebp
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
dec esi
jne 0x41a495
pop esi
pop ebp
push dword [esp + 0x3c]
lea ecx, [esp + 0x14]
call fcn.0040f6d7
mov dword [esp + 0x30], ebx
cmp dword [esp + 0x24], 0x10
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x10]
cmovae ecx, dword [esp + 0x10]
lea edx, [esp + 0x10]
cmovae edx, dword [esp + 0x10]
add eax, ecx
cmp dword [esp + 0x24], 0x10
push 0x41c60b
push edx
push eax
lea ecx, [esp + 0x1c]
cmovae ecx, dword [esp + 0x1c]
push ecx
lea eax, [esp + 0x1c]
push eax
call fcn.0040746d
add esp, 0x14
lea eax, [esp + 0x10]
push dword [esp + 0x40]
lea ecx, [edi + 0xc]
push eax
call fcn.004156dd
mov ecx, eax
call fcn.0040fab1
or dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.0040165f
mov ecx, dword [esp + 0x28]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x426be7
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x437580]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [fcn.0041a96e]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0041eee7
mov dword [ebp - 0x14], eax
cmp dword [0x43bbb8], edi
jne 0x426cd8
push 0x800
push edi
push 0x430760
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x426c65
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x426db8
push 0x430760
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x426db8
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x426db8
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x43bbb8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x43bbbc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x43bbc0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43bbc8], eax
test eax, eax
je 0x426cd5
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43bbc4], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x426cfd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x426cf0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x426d12
push 4
pop eax
jmp 0x426dba
cmp dword [ebp - 0x14], edi
je 0x426d12
push dword [0x43bbb8]
call dword [fcn.0041a972]
push 3
jmp 0x426cf7
mov eax, dword [0x43bbc4]
mov ebx, dword [fcn.0041a972]
cmp eax, esi
je 0x426d70
cmp dword [0x43bbc8], esi
je 0x426d70
push eax
call ebx
push dword [0x43bbc8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x426d70
test eax, eax
je 0x426d70
call ecx
test eax, eax
je 0x426d65
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x426d65
test byte [ebp - 8], 1
jne 0x426d70
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x426da0
mov eax, dword [0x43bbbc]
cmp eax, esi
je 0x426d9d
push eax
call ebx
test eax, eax
je 0x426d9d
call eax
mov edi, eax
test edi, edi
je 0x426d9d
mov eax, dword [0x43bbc0]
cmp eax, esi
je 0x426d9d
push eax
call ebx
test eax, eax
je 0x426d9d
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x43bbb8]
call ebx
test eax, eax
je 0x426db8
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x426dba
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ec5c
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x30a026db
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x13a15814
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4031c4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x406034], 0
je 0x403225
cmp word [0x406208], 0xd7b2
jne 0x4031ed
cmp dword [0x406210], 0
jbe 0x4031ed
mov eax, 0x406204
call dword [0x406220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x405058
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40324c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x40501c], 0
jne 0x403241
push 0
push 0x405050
push 0x405058
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403968
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4039ce
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040343c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040299c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4039b8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4039d5
lea eax, [ebp - 0x10]
call fcn.00403348
ret

Function at 0x4040a4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004034e0
xor eax, eax
push ebp
push 0x404150
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
lea eax, [ebp - 7]
push eax
push 0xf
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
push 2
lea eax, [ebp - 0xa]
push eax
push 0xe
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0x3d]
xor ecx, ecx
mov edx, 0x18
call fcn.0040297c
mov dword [ebp - 0x35], 3
lea eax, [ebp - 0xa]
mov dword [ebp - 0x31], eax
lea eax, [ebp - 7]
mov dword [ebp - 0x2d], eax
push 0x1a
lea eax, [ebp - 0x25]
push eax
lea eax, [ebp - 0x3d]
push eax
mov eax, dword [ebp - 4]
call fcn.004034f0
push eax
push 0
push 0x400
call sub.kernel32.dll_GetNumberFormatA
mov eax, ebx
lea edx, [ebp - 0x25]
mov ecx, 0x1b
call fcn.0040343c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404157
lea eax, [ebp - 4]
call fcn.00403348
ret
Function at 0x40454c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov edi, 0x40668c
xor eax, eax
push ebp
push 0x404714
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0x184
mov eax, dword [0x406684]
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x1c]
push eax
push 0x14
push 0xd
mov eax, dword [0x406680]
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 1
mov dword [edi], 0
mov dword [edi + 4], 0
jmp 0x4045f7
mov esi, ebx
and esi, 0xff
sub esi, 0x30
test esi, esi
jl 0x4046f9
cmp esi, 9
jg 0x4046f9
push 0
push 0xa
mov eax, dword [edi]
mov edx, dword [edi + 4]
call fcn.00403708
push edx
push eax
mov eax, esi
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [edi], eax
mov dword [edi + 4], edx
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
mov bl, byte [eax]
test bl, bl
jne 0x4045b6
mov dword [ebp - 4], 2
cmp dword [edi + 4], 0
jne 0x404617
cmp dword [edi], 0
jae 0x40461d
jmp 0x4046f9
jl 0x4046f9
mov dword [ebp - 4], 3
cmp dword [edi + 4], 0
jne 0x404634
cmp dword [edi], 1
ja 0x40463a
jmp 0x4046f9
jle 0x4046f9
call fcn.00404350
call sub.kernel32.dll_GetTickCount
mov ebx, eax
cmp dword [edi + 4], 0
jne 0x40464f
cmp dword [edi], 2
je 0x40466c
cmp dword [edi + 4], 0
jne 0x40465a
cmp dword [edi], 3
je 0x40466c
cmp dword [edi + 4], 0
jne 0x404665
cmp dword [edi], 5
je 0x40466c
call fcn.004043c0
call sub.kernel32.dll_GetTickCount
sub eax, ebx
mov ebx, eax
push 0
push 0
push 0x18b
mov eax, dword [0x406684]
push eax
call sub.user32.dll_SendMessageA
test eax, eax
jne 0x4046ae
push dword [edi + 4]
push dword [edi]
lea eax, [ebp - 0x20]
call fcn.004041d4
mov eax, dword [ebp - 0x20]
call fcn.0040428c
mov eax, 0x404730
call fcn.0040428c
jmp 0x4046d2
cmp dword [edi + 4], 0
jne 0x4046bb
cmp dword [edi], 1
jbe 0x4046d2
jmp 0x4046bd
jle 0x4046d2
push dword [edi + 4]
push dword [edi]
lea eax, [ebp - 0x24]
call fcn.004041d4
mov eax, dword [ebp - 0x24]
call fcn.0040428c
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.004044c4
mov eax, dword [ebp - 0x28]
call fcn.004034f0
push eax
push 0
push 0xc
mov eax, dword [0x406688]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40471b
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.0040336c
ret