joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4044c8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40452e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403934
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.004027c0
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404518
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404535
lea eax, [ebp - 0x10]
call fcn.004036ec
ret

Function at 0x4063a4
Capabilities:
Get graphical window text

Disassembly:
xchg edx, eax
movzx ecx, byte [edx + 0x3a]
jecxz 0x4063b3
mov edx, dword [edx + 0x36]
jmp fcn.004038c8
mov ecx, dword [edx + 0x18]
jecxz 0x4063ab
push ebx
push esi
xchg ebx, eax
mov esi, ecx
push esi
call sub.user32.dll_GetWindowTextLengthA
mov edx, eax
inc eax
push eax
mov eax, ebx
call fcn.00403c90
pop edx
mov ecx, dword [ebx]
jecxz 0x4063db
push edx
push ecx
push esi
call sub.user32.dll_GetWindowTextA
pop esi
pop ebx
ret

Function at 0x408e0c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x408e45
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004037dc
jmp 0x408e4e
mov eax, ebx
mov edx, esi
call fcn.00403740
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x408e58
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x408e79
mov al, byte [esp]
jmp 0x408e7b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x409f70
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x409fd4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403934
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00407fa0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409fdb
lea eax, [ebp - 0xc]
call fcn.004036ec
ret
Function at 0x40da48
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 4]
jge 0x40da94
mov eax, dword [ebp - 0xc]
shr eax, 8
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [edx + ecx]
xor edx, dword [ebp - 0xc]
and edx, 0xff
xor eax, dword [edx*4 + 0x4107e8]
mov dword [ebp - 0xc], eax
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 4]
jl 0x40da66
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x40ac40
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a6a8]
jne 0x40ac4a
repz ret
jmp fcn.00411bfc

Function at 0x417c4c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a6a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040f688
and dword [ebp - 0x14], 0
cmp dword [0x44d31c], 0
mov dword [ebp - 0x18], eax
jne 0x417cff
push 0x403814
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x417da7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403808
push ebx
call edi
test eax, eax
je 0x417da7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4037f8
push ebx
mov dword [0x44d31c], eax
call edi
push eax
call esi
push 0x4037e4
push ebx
mov dword [0x44d320], eax
call edi
push eax
call esi
push 0x4037c8
push ebx
mov dword [0x44d324], eax
call edi
push eax
call esi
mov dword [0x44d32c], eax
test eax, eax
je 0x417cff
push 0x4037b0
push ebx
call edi
push eax
call esi
mov dword [0x44d328], eax
mov eax, dword [0x44d328]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x417d58
cmp dword [0x44d32c], ecx
je 0x417d58
push eax
call esi
push dword [0x44d32c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x417d58
test ebx, ebx
je 0x417d58
call edi
test eax, eax
je 0x417d4f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x417d4f
test byte [ebp - 8], 1
jne 0x417d58
or dword [ebp + 0x10], 0x200000
jmp 0x417d8b
mov eax, dword [0x44d320]
cmp eax, dword [ebp - 0x18]
je 0x417d8b
push eax
call esi
test eax, eax
je 0x417d8b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x417d8b
mov eax, dword [0x44d324]
cmp eax, dword [ebp - 0x18]
je 0x417d8b
push eax
call esi
test eax, eax
je 0x417d8b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44d31c]
call esi
test eax, eax
je 0x417da7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x417da9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ac40
leave
ret
Function at 0x422620
Capabilities:
Access the windows event log
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1004
call fcn.00421960
cmp dword [0x7ee0a0], 0x37
jne 0x4226cf
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0x404498
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [esp + 0x808]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4044b8
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PrepareTape]
push 0
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push 0
lea eax, [esp + 0x408]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
mov ecx, dword [0x7ee0a4]
mov eax, dword [0x7ea510]
mov dl, byte [ecx + esi + 0x38d6]
mov byte [eax + esi], dl
add esp, 0x1004
ret
Function at 0x401560
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401579
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4015b4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4015b0
lea ebx, [ebx]
cmp esi, eax
jae 0x4015b4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4015a0
cmp esi, eax
jb 0x4015ba
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x40deb0
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x482dd8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x4b13bc]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b13bc]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x74]
push 8
xor ebx, ebx
push str.tnCcNAH4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
call fcn.00403290
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov al, 0x6c
push ebx
mov byte [esp + 0x56], al
mov byte [esp + 0x58], al
mov byte [esp + 0x59], al
mov byte [esp + 0x45], al
mov byte [esp + 0x4a], al
mov byte [esp + 0x4b], al
mov cl, 0x75
push ebx
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x78], ebx
mov byte [esp + 0x58], 0x56
mov byte [esp + 0x59], 0x69
mov byte [esp + 0x5a], 0x72
mov byte [esp + 0x5b], 0x74
mov byte [esp + 0x5c], cl
mov byte [esp + 0x5d], 0x61
mov byte [esp + 0x5f], 0x41
mov byte [esp + 0x62], 0x6f
mov byte [esp + 0x63], 0x63
mov byte [esp + 0x64], 0x45
mov byte [esp + 0x65], 0x78
mov byte [esp + 0x66], 0x4e
mov byte [esp + 0x67], cl
mov byte [esp + 0x68], 0x6d
mov byte [esp + 0x69], 0x61
mov byte [esp + 0x6a], bl
mov byte [esp + 0x48], 0x6b
mov byte [esp + 0x49], 0x65
mov byte [esp + 0x4a], 0x72
mov byte [esp + 0x4b], 0x6e
mov byte [esp + 0x4c], 0x65
mov byte [esp + 0x4e], 0x33
mov byte [esp + 0x4f], 0x32
mov byte [esp + 0x50], 0x2e
mov byte [esp + 0x51], 0x64
mov byte [esp + 0x54], bl
call esi
lea ecx, [esp + 0x4c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push ebx
lea edx, [esp + 0x38]
push edx
mov edi, eax
mov byte [esp + 0x3c], 0x74
mov byte [esp + 0x3d], 0x61
mov byte [esp + 0x3e], 0x73
mov byte [esp + 0x3f], 0x6b
mov byte [esp + 0x40], 0x6d
mov byte [esp + 0x41], 0x67
mov byte [esp + 0x42], 0x72
mov byte [esp + 0x43], 0x2e
mov byte [esp + 0x44], 0x65
mov byte [esp + 0x45], 0x78
mov byte [esp + 0x46], 0x65
mov byte [esp + 0x47], bl
call esi
test eax, eax
jne 0x40e026
cmp dword [esp + 0x2c], 0x10
jb 0x40e01f
mov eax, dword [esp + 0x18]
push eax
call fcn.00410354
add esp, 4
xor al, al
jmp 0x40e0b4
push ebx
push 0x489148
call fcn.004543ea
add esp, 4
push eax
push 0x489140
call fcn.004543ea
add esp, 4
or eax, 0x1000
push eax
push 0x8544
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
mov esi, eax
cmp esi, ebx
jne 0x40e075
cmp dword [esp + 0x2c], 0x10
jb 0x40e01f
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00410354
add esp, 4
xor al, al
jmp 0x40e0b4
push 0x8544
push 0x4a70a8
push esi
call fcn.00454430
mov edx, dword [esp + 0x84]
push 0x8544
push esi
push edx
push ebp
call fcn.004036e0
add esp, 0x1c
call esi
cmp dword [esp + 0x2c], 0x10
jb 0x40e0b2
mov eax, dword [esp + 0x18]
push eax
call fcn.00410354
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.0045380a
add esp, 0x5c
ret
Function at 0x414120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x414144
cmp dword [edi + 0x54], 0
jne 0x414144
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.00423372
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.004140e1
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x414cd9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x414d21
call fcn.00423372
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x414d21
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x414d64
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x414d4d
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x414d4d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x414d61
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x41d01d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x41d064
call fcn.00423372
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41d064
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x41d080
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041cb97
mov esi, eax
test edi, edi
je 0x41d07e
test ebx, ebx
je 0x41d07e
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41dbd9
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x483dc1
call fcn.00454e73
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x41dbfe
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x41dc44
lea ecx, [ebp - 0x10]
call fcn.00402a80
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041d092
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401670
mov eax, esi
call fcn.00454f4b
ret 8

Function at 0x438b85
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x4855fe
call fcn.00454e73
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.0040e1e0
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x438be7
call fcn.004227b4
cmp eax, 1
jne 0x438be7
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.0040fae0
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.0040fa60
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401670
mov dword [ebp + 8], SysReAllocStringLen
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401670
mov eax, esi
call fcn.00454f4b
ret 0x10

Function at 0x438c10
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x485629
call fcn.00454e73
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.0040e1e0
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x438c72
call fcn.004227b4
cmp eax, 1
jne 0x438c72
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.0040fae0
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.0040fa60
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401670
mov dword [ebp + 8], SysReAllocStringLen
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401670
mov eax, esi
call fcn.00454f4b
ret 0x14
Function at 0x438c9e
Capabilities:
Delete registry key

Disassembly:
push 0
mov eax, 0x485654
call fcn.00454e73
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.0040e1e0
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x438d00
call fcn.004227b4
cmp eax, 1
jne 0x438d00
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.0040fae0
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.0040fa60
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401670
mov dword [ebp + 8], SysReAllocStringLen
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401670
mov eax, esi
call fcn.00454f4b
ret 8

Function at 0x45380a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b13bc]
jne 0x453814
repz ret
jmp fcn.0045cbbc

Function at 0x475ba0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0045c580
and dword [ebp - 4], 0
cmp dword [0x4b5564], 0
mov ebx, eax
jne 0x475c51
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x475d02
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4937a4
push edi
call esi
test eax, eax
je 0x475d02
push eax
call fcn.0045c50e
mov dword [esp], 0x493794
push edi
mov dword [0x4b5564], eax
call esi
push eax
call fcn.0045c50e
mov dword [esp], 0x493780
push edi
mov dword [0x4b5568], eax
call esi
push eax
call fcn.0045c50e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4b556c], eax
call esi
push eax
call fcn.0045c50e
pop ecx
mov dword [0x4b5574], eax
test eax, eax
je 0x475c51
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0045c50e
pop ecx
mov dword [0x4b5570], eax
mov eax, dword [0x4b5570]
cmp eax, ebx
je 0x475ca9
cmp dword [0x4b5574], ebx
je 0x475ca9
push eax
call fcn.0045c589
push dword [0x4b5574]
mov esi, eax
call fcn.0045c589
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x475ca9
test edi, edi
je 0x475ca9
call esi
test eax, eax
je 0x475ca0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x475ca0
test byte [ebp - 0xc], 1
jne 0x475ca9
or dword [ebp + 0x10], 0x200000
jmp 0x475ce2
mov eax, dword [0x4b5568]
cmp eax, ebx
je 0x475ce2
push eax
call fcn.0045c589
pop ecx
test eax, eax
je 0x475ce2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x475ce2
mov eax, dword [0x4b556c]
cmp eax, ebx
je 0x475ce2
push eax
call fcn.0045c589
pop ecx
test eax, eax
je 0x475ce2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4b5564]
call fcn.0045c589
pop ecx
test eax, eax
je 0x475d02
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x475d04
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x100019e6
Capabilities:
Create thread
Resume thread
Terminate thread

Disassembly:
push esi
xor esi, esi
push esi
push 4
push esi
push 0x100018d3
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xfffffffffffffff1
push eax
mov dword [0x10003298], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x10001a1d
push dword [0x10003298]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x10001a30
push esi
push dword [0x10003298]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x10003298], esi
pop esi
ret

Function at 0x10001707
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
push edi
mov ecx, dword [esi + 0x3c]
mov eax, dword [ecx + esi + 0x78]
lea edi, [eax + esi]
mov ecx, dword [ecx + esi + 0x7c]
mov dword [ebp - 4], ecx
mov eax, dword [edi + 0x20]
lea eax, [eax + ebx*4]
mov eax, dword [eax + esi]
add eax, esi
push eax
push dword [ebp + 0xc]
call fcn.100016da
pop ecx
test eax, eax
pop ecx
jne 0x1000176e
xor ebx, ebx
cmp dword [edi + 0x18], ebx
jbe 0x10001767
mov eax, dword [edi + 0x20]
lea eax, [eax + ebx*4]
mov eax, dword [eax + esi]
add eax, esi
push eax
push dword [ebp + 0xc]
call fcn.100016da
pop ecx
test eax, eax
pop ecx
jne 0x1000176e
inc ebx
cmp ebx, dword [edi + 0x18]
jb 0x10001747
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [edi + 0x24]
mov ecx, dword [edi + 0x1c]
lea eax, [eax + ebx*2]
movzx eax, word [eax + esi]
lea eax, [ecx + eax*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x10001769
Function at 0x401790
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0x401860
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x401860
mov esi, 0x1505
cmp dword [esp + 0x28], 0
je 0x4017e0
xor ebx, ebx
nop
nop
movzx ecx, byte [ebp + ebx]
test ecx, ecx
je 0x4017e0
mov edx, esi
shl edx, 5
mov edi, edx
and edi, esi
xor edx, esi
add edx, ecx
lea esi, [edx + edi*2]
inc ebx
cmp dword [esp + 0x28], ebx
jne 0x4017c0
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
lea edi, [ebx - 1]
mov edx, ebx
sub edx, 1
mov dword [esp + 8], edx
jb 0x401860
and edi, esi
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0x401804
inc edi
dec ebx
je 0x40185e
mov eax, edi
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0x40185e
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0x401800
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.004082d0
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0x401800
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.004082f0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0x401800
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0x401860
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret