joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10065f6a
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10081040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1005b60d
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1005b60d
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10065fe1
cmp word [ecx], dx
je 0x10065fe1
mov eax, dword [0x10070474]
push edi
dec eax
push eax
push 0x10070360
call fcn.10065f09
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10066054
cmp word [eax], dx
je 0x10066054
mov eax, dword [edi]
test eax, eax
je 0x10066005
cmp word [eax], dx
je 0x10066005
lea eax, [ebp - 0x10]
push eax
call fcn.100658ec
jmp 0x1006600e
lea eax, [ebp - 0x10]
push eax
call fcn.10065987
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1006607e
mov eax, dword [0x1007035c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10070050
call fcn.10065f09
add esp, 0xc
test al, al
je 0x1006607e
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10066049
cmp word [eax], di
je 0x10066049
lea eax, [ebp - 0x10]
push eax
call fcn.100658ec
pop ecx
jmp 0x10066080
lea eax, [ebp - 0x10]
push eax
call fcn.10065987
jmp 0x10066046
mov eax, dword [edi]
test eax, eax
je 0x1006606b
cmp word [eax], dx
je 0x1006606b
lea eax, [ebp - 0x10]
push eax
call fcn.100658a1
pop ecx
jmp 0x1006607e
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10066149
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10065d8e
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10066149
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10066149
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10066149
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100660d6
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1005d5f6
test ebx, ebx
je 0x10066144
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1005d5f6
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10066149
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10066149
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.100679e4
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1006614b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10052106
leave
ret
Function at 0x10069080
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100690ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100690ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40601c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x406028
push 0x406024
push 0x406020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x406028]
push dword [0x406024]
push dword [0x406020]
mov dword [0x406014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x84], 0
call fcn.00401a4a
mov esi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, esi
or al, 0x40
push eax
lea eax, [0x404561]
lea edx, [fcn.00401ac0]
sub eax, edx
push eax
push fcn.00401ac0
call sub.KERNEL32.dll_VirtualProtect
cmp dword [ebp - 4], 0
je 0x401337
push esi
call fcn.00401922
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.00401976
mov eax, esi
add eax, 0x1d600
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
mov edi, dword [ebp - 0x88]
mov eax, esi
mov ecx, edi
or cl, 1
cdq
idiv ecx
mov ebx, eax
add ebx, edi
push ebx
lea edi, [0x4060e4]
mov ebx, esi
dec ebx
and edi, ebx
push edi
call fcn.00401ac0
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401a4a
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push edi
and dword [ebp - 0x118], 0
xor edi, edi
mov dword [ebp - 0x114], 0xa
mov byte [ebp - 0x104], 0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10e]
push eax
push 1
push 1
lea eax, [ebp - 0x104]
push eax
call sub.CRYPT32.DLL_CryptBinaryToStringA
movsx edi, byte [ebp - 0x10e]
sub edi, 0x41
lea eax, [ebp - 0x120]
push eax
call sub.USER32.DLL_GetCursorPos
call sub.KERNEL32.dll_GetLastError
mov eax, edi
pop edi
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40105b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x429004]
jne 0x401065
repz ret
jmp fcn.00401684

Function at 0x4048db
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x429004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040382b
and dword [ebp - 0x14], 0
cmp dword [0x42b930], 0
mov dword [ebp - 0x18], eax
jne 0x40498e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404a36
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404a36
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42b930], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42b934], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42b938], eax
call edi
push eax
call esi
mov dword [0x42b940], eax
test eax, eax
je 0x40498e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42b93c], eax
mov eax, dword [0x42b93c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4049e7
cmp dword [0x42b940], ecx
je 0x4049e7
push eax
call esi
push dword [0x42b940]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4049e7
test ebx, ebx
je 0x4049e7
call edi
test eax, eax
je 0x4049de
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4049de
test byte [ebp - 8], 1
jne 0x4049e7
or dword [ebp + 0x10], 0x200000
jmp 0x404a1a
mov eax, dword [0x42b934]
cmp eax, dword [ebp - 0x18]
je 0x404a1a
push eax
call esi
test eax, eax
je 0x404a1a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x404a1a
mov eax, dword [0x42b938]
cmp eax, dword [ebp - 0x18]
je 0x404a1a
push eax
call esi
test eax, eax
je 0x404a1a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42b930]
call esi
test eax, eax
je 0x404a36
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404a38
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040105b
leave
ret
Function at 0x401005
Capabilities:
Access peb ldr_data

Disassembly:
push 0
push 2
push 0x403071
push 0x403053
call dword [sym.imp.Winmm.dll_mciSendStringA]
cmp eax, 0x107
je 0x401021
ret
mov edi, edi
mov esi, 0x402058
mov edi, esi
push 1
push 0x40308f
push 1
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateSemaphoreW]
mov edx, eax
pop ebx
mov ecx, 0x340
mov al, byte [esi]
sub al, bl
stosb byte es:[edi], al
inc esi
loop 0x401045
push dword fs:[0x30]
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
cmp word [eax], 0x5a4d
je 0x40106b
xor eax, eax
mov dword [0x4030a2], eax
add esp, 4
ret

Function at 0x402910
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x402969
mov edx, dword [ebp - 0x4c]
add edx, 1
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
movsx ecx, byte [eax]
test ecx, ecx
je 0x402953
mov edx, dword [ebp - 0x4c]
movsx eax, byte [edx]
cmp eax, 0x22
je 0x402953
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov dword [ebp - 0x4c], ecx
jmp 0x402933
mov edx, dword [ebp - 0x4c]
movsx eax, byte [edx]
cmp eax, 0x22
jne 0x402967
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov dword [ebp - 0x4c], ecx
jmp 0x40297f
mov edx, dword [ebp - 0x4c]
movsx eax, byte [edx]
cmp eax, 0x20
jle 0x40297f
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov dword [ebp - 0x4c], ecx
jmp 0x402969
mov edx, dword [ebp - 0x4c]
movsx eax, byte [edx]
test eax, eax
je 0x40299f
mov ecx, dword [ebp - 0x4c]
movsx edx, byte [ecx]
cmp edx, 0x20
jg 0x40299f
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x4c], eax
jmp 0x40297f
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00402a40
push 0x404004
push section..data
jmp 0x4074b4
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1014
push ebp
mov ebp, esp
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
or eax, 0xffffffff
mov dword [0x415c84], 9
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
mov dword [ebp - 8], eax
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
mov ecx, 0x1000
xor eax, eax
lea edx, [ebp - 0x1010]
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
mov edi, eax
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
test eax, eax
mov esi, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0xe092c8
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
add esi, 4
mov edx, 0x8a35c9a9
mov edi, ecx
movsx ebp, dl
neg edx
mov ebp, esi
pop edx
jb 0xfeaf27

Function at 0xe112f2
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
rol cl, 1
rol dword [esp + 5], 0xdb
jb 0xe0441e
add dword [esp + 7], 0x3a9c4e84
adc cl, 0x9c
not cl
sub word [esp], 0x548d
rol cl, 1
jmp 0xe11a86
lea edi, [edi + ecx*2 - 0x7c7f7d6a]
inc ecx
mov dword [esp + ecx - 0x3e3fbeb8], ecx
lea ebp, [ebp + ecx*2 - 0x7c7f7d71]
inc cl
movzx ecx, byte [ebp + ecx*2 - 0x7c7f7d72]
sar dword [esp], 0xf3
xor cl, bl
jmp 0xe25708
xor cl, 0x8e
jmp 0xe3a1c3
push 0x121e98b8
dec cl
neg dword [esp + 2]
jl 0xe34877
jne 0xdf3afc
push 0x2ae47a0
rol word [esp + 0xb], 0x21
rol cl, 1
xor bl, cl
jmp 0x13b0def
call fcn.00ee69f0
mov eax, 0xfe295c2f
mov edx, dword [edi]
call fcn.00e260ff

Function at 0xe14f97
Capabilities:
Encode data using xor

Disassembly:
jp 0xe2c4b8
push 0xceb7c20d
mov eax, 0x1797100d
pop edx
mov esp, edi
popfd
call fcn.012a7794

Function at 0xe24035
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
or ecx, 0x4c8b05bf
and eax, 0x724ce804
pop ecx
add cl, ch
jmp 0x13b7b7e
mov eax, 0x7311093
inc eax
mov ecx, 0x66bb9cab
mov ecx, dword [edi + eax*8 - 0x398884a0]
call fcn.00ee56bd
call fcn.012966e9
or al, 0xa5
faddp st(7)
lea ecx, [esi - 0x41]
push 0x45
test al, 0xeb
salc
xchg esp, eax
jg 0xe24023
stosd dword es:[edi], eax
add al, 0xe1
mov byte [0xa7982dbf], al
rol dword [edi + 0xa601e63], 0xa6
shl byte [ebx - 0x3f], 1
ja 0xe240ed
insd dword es:[edi], dx
cmp dh, bl
or ah, byte [esp + edx*8 + 0x49]
cld
pushal
add byte [edi + 0x53], dl
xor bl, byte [edi + 0x33]
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edx], cl
or cl, byte [edi + 4]
push 0x129611a5
push 0x45be88b7
jmp 0xff1e6c

Function at 0xe2d668
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
sub al, 0xbe
sal dword [esp], 0xf2
xor al, 0xbb
shr byte [esp + 1], 0x63
mov dword [esp], 0x468f1e2e
neg al
dec byte [esp]
call fcn.013b6de4
ljmp 0xc848
mov dword [esp], 0x5265321
xor al, 8
dec word [esp]
jge 0xe05c2c

Function at 0xe49158
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
neg dword [esp + 8]
jle 0xfe417a
test di, dx
cmp esp, edi
lea edx, [esp + edx + 0x10]
push 0xc328598a
call fcn.00deff51
movzx dx, byte [esi]
jmp 0x101337f
mov cl, byte [esi + 2]
add esi, 2
jmp 0xe1ec16

Function at 0xfb1945
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [esp], 0x96bf7439
ror al, 1
xor bl, al
inc dword [esp + 8]
lea eax, [esp + eax + 0x14]
call fcn.00ff7685

Function at 0xfb195e
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [eax], edx
lea esp, [esp + 0xc]
jp fcn.012a104e
lea eax, [esp + eax + 0xc]
jne 0xe318ae
Function at 0xfb4af5
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
lea esp, [esp + 4]
jmp fcn.00e0e46f
jmp 0xdfb4d3
adc esi, 7
push 0x5a86b97
jmp 0x13ab900
sahf
mov al, 0x9c
dec esi
mov esi, 0xf23b5014
cmp esi, edx
jmp 0x1026dc2
jb 0xe24fd9
jle 0xfb4ac1
pushal
pop ebx
jle 0xfb4b0b
mov edx, 0x9ad7e410
loop 0xfb4b56
jmp 0xe6d7c11
jb 0xfb4b1a
pop ebx
mov dh, 0xef
jb 0xfb4aff
bound eax, qword [ebx + 0x3ec69436]
mov eax, 0xf3d4e72d
in eax, dx
out 0xd4, eax
in eax, dx
out 0x83, al
push eax
js 0xfb4b82
leave
out dx, al
outsb dx, byte [esi]
aad 0xcd
js 0xfb4b2e
sti
rcl byte [edx + 0x6b]
shl dword [edx], 1
imul edx, ecx, 0x22
popal
call fcn.00fea2ff
mov ecx, dword [ebp]
mov edx, 0xf81c17bb
rol edx, 0x89
mov dx, word [ecx + edx*2 - 0x705eefe0]
adc ebp, 2
jmp 0x1027bc7
push ecx
and byte [eax], dl
mov eax, dword [0x2d5818f]
add byte [eax], al
add cl, ch
jno 0xfb4b84
pop es
add byte [ebx], ch
cli
mov eax, dword [edi]
add byte [0x82dee7e2], ah
rcr dword [ebx - 0x23], 1
jmp 0xfb4b46
push 0xff38c91d
lea esp, [esp + 0x10]
ja fcn.00e455c1
mov edx, 0x6034e6a1
mov ecx, edx
sar dl, 2
mov eax, esp
mov edi, 0xa530d409
lea ecx, [edx - 0x6034e680]
lea edx, [esi + edx - 0x6034e768]
bt edi, 0x8d
and edi, edi
sal di, 0x4c
and edx, 0xfffffffc
lea edi, [edi + edi*2 - 0x10f0e8e7]
dec di
sub edx, ecx
mov esp, edx
bswap edi
push esi
call fcn.00def1bb
syscall
call fcn.013ab369
mov word [edi], bp
push 0x12026939
jmp 0xe01eaf
jmp fcn.00fe3e56
mov dword [ecx], edx
lea esp, [esp + 8]
jmp fcn.00e0bbae

Function at 0xfb9f2d
Capabilities:
Encode data using xor

Disassembly:
xor cl, bl
mov dword [esp], 0xfe31779e
ror dword [esp], 0x6e
shl dword [esp], 0xf9
adc cl, 0xad
call fcn.00e13983
mov ebp, 0x99ade7ad
sub edi, 1
lea edx, [ebp - 0x18cb495a]
btr ebp, 4
adc ebp, 0x191e9502
movzx edx, byte [edi]
xor dl, bl
add bp, bp
or bp, 0xf0f
sbb bp, bp
adc dl, 0xd
rol bp, 0x8a
rol ebp, 0x8a
shr ebp, 0x17
not dl
adc dl, 0xa8
neg ebp
rol dl, 1
xor bl, dl
sub ebp, ebp
jp 0xfcf0c9
or ecx, dword [esi - 0x40590d4d]
stosd dword es:[edi], eax
cmp eax, 0x2eafd385
cli
xor al, bh
movsd dword es:[edi], dword [esi]
cmc
mov edx, 0xfcf63ab7
xor eax, 0x69b628be
dec eax
push eax
sal byte [esi], 0xe5
xor byte [esi + edx + 0x46de859], ch
je 0xfb9f5d
push ds
cli
popfd
out 0xc5, eax
push edx
sbb al, 0xbc
invalid
sal ebp, 0xa8
adc edx, esp
rol ebp, 0xef
dec ebp
movzx bp, byte [edx]
sbb esi, 2
call fcn.012bd2df
Function at 0xff7685
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
not word [esp + 7]
mov dword [eax], ecx
jp fcn.00e0dbe4
jp 0xe44b67
mov word [esp + 0x16], 0x782c
lea esp, [esp + 0x18]
jg fcn.00e3dc8b

Function at 0x1017f1e
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
dec eax
mov dword [esp], 0x8a26ba0d
dec eax
ror dword [esp], 4
inc cx
ror ebx, 1
shr word [esp + 4], 0xea
jae 0x13c1427
jb 0x102a7e9
inc cx
dec ebx
jmp 0xfeb2f2

Function at 0x10199a3
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov dword [esi + 0xc], eax
push 0x3c2aea8e
jmp 0x12bfe0c
sbb esi, 8
jmp 0x12b34a6
mov dword [esp], 0xf5b973b1
jns 0xe0ba58
push 0x3f837a2c
inc dword [esp]
add dword [esp], 0xf3a4aa9e
mov eax, dword [ebp]
adc dword [esp], 0xef9878b8
mov esi, 0x28d299b
rol esi, 0x98
mov esi, dword [ebp + 4]
call fcn.01036159
mov dword [esi + 8], ebx
mov dword [esi + 4], ecx
mov ebx, 0x66b238b2
mov dword [ebx + esi - 0x66b238b2], edx
not bx
mov ebx, dword [esp + ebx - 0x66b2c745]
lea esp, [esp + 0xc]
jmp fcn.013c574b
jmp 0xe01857
jmp 0x103d9ae

Function at 0x1031a66
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
neg edi
jmp 0x1031a51
add edi, 0xe805d380
mov dword [esp], 0x1bbed00e
neg edi
call fcn.00e240a2
mov eax, 0xa588eb90
lea ecx, [eax + eax*8 + 0x3691652b]
sub ax, cx
mov edx, dword [ebp + ecx - 0x861ad3b]
mov eax, dword [ebp + ecx*4 - 0x2186b4e8]
push ecx
adc ecx, 0xd8367ab7
mov ecx, dword [ebp + 8]
ja 0x12b14ae
notrack call 0x2e9d1540
pushal
cdq
int3
jnp 0xe349ca

Function at 0x12baf2e
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp - 4], eax
mov dword [esp], 0x69bec53e
test ebx, ebx
jmp 0xe588fd
call fcn.00fb32bd
jmp 0x13b094d
ror dword [esp + 5], 0x9a
jb 0xe05ae6
call fcn.013b264e
lea esp, [esp + 0x14]
je 0x13b0988
mov eax, 0x8c83aba7
xor eax, 0xb3a86cab
or eax, eax
mov eax, dword [ebp + ebx*4]
push 0xe02a948e
dec dword [esp]
dec byte [esp + 2]
mov dword [esp], eax
push 0xee238390
dec ebx
lea esp, [esp + 4]
jne 0x13b0957
mov eax, 0x5100af9f
not al
lea eax, [eax*2 + 0x4e0fdc2f]
mov eax, dword [ebp]
call eax
mov edi, 0xdf000196
jmp 0xe4bed4

Function at 0x13bc407
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub edx, edx
pop edi
lea esi, [esi + edx*2 + 4]
movzx edi, dx
je 0x13bc463
add al, 0xf
mov bh, 0xfa
btc dx, dx
mov eax, edx
xchg ebp, esi
bswap edx
or edi, ebp
movzx ebp, dl
dec al
jns 0xe3dc78
dec ecx
sahf
lea ebx, [ecx]
inc esp
dec esp
mov al, byte [0x6a8dbde9]
adc al, 0xc3
adc dword [esi + 0x2a62479], eax
inc edi
pop edi
wait
fldcw word [ebx - 0x2b]
sub dword [ebp - 0xa], edx
inc esp
loop 0x13bc40b
imul dword [edx - 0x34]
jecxz 0x13bc4bd
aam 0x50
pop ecx
push esp
test byte [ecx + esi*8 - 0x34a62298], dl
aas
add dword [eax], eax
add byte [eax], al
jo 0x13bc422
into
fistp dword [esp + esi*2 - 0x18]
inc ebx
mov ch, byte [ecx]
hlt
xor dword [ebx], 0
retf
Function at 0x40105b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x433004]
jne 0x401065
repz ret
jmp fcn.00401684

Function at 0x40495b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x433004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040382b
and dword [ebp - 0x14], 0
cmp dword [0x435928], 0
mov dword [ebp - 0x18], eax
jne 0x404a0e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404ab6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404ab6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x435928], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x43592c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x435930], eax
call edi
push eax
call esi
mov dword [0x435938], eax
test eax, eax
je 0x404a0e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x435934], eax
mov eax, dword [0x435934]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404a67
cmp dword [0x435938], ecx
je 0x404a67
push eax
call esi
push dword [0x435938]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404a67
test ebx, ebx
je 0x404a67
call edi
test eax, eax
je 0x404a5e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x404a5e
test byte [ebp - 8], 1
jne 0x404a67
or dword [ebp + 0x10], 0x200000
jmp 0x404a9a
mov eax, dword [0x43592c]
cmp eax, dword [ebp - 0x18]
je 0x404a9a
push eax
call esi
test eax, eax
je 0x404a9a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x404a9a
mov eax, dword [0x435930]
cmp eax, dword [ebp - 0x18]
je 0x404a9a
push eax
call esi
test eax, eax
je 0x404a9a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x435928]
call esi
test eax, eax
je 0x404ab6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404ab8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040105b
leave
ret