joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cf1c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x10]
cmp eax, dword [ecx + 8]
jbe 0x4cf3ef
sub esp, 0x90
mov eax, 0
mov dword [esp + 0x8c], eax
mov byte [esp + 0x33], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
lea eax, [0x4e6650]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x4c], eax
test byte [eax], al
mov dword [esp], eax
lea ecx, [esp + 0x48]
mov dword [esp + 4], ecx
call fcn.0046b360
nop
mov eax, dword [esp + 0x94]
mov ecx, dword [eax + 0xc]
mov dword [esp], ecx
lea ecx, [esp + 0x33]
mov dword [esp + 4], ecx
call fcn.00405af0
movzx eax, byte [esp + 8]
test al, al
je 0x4cf3dc
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
lea eax, [0x4cf400]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x44], eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x8c], ecx
mov byte [esp + 0x33], 1
call fcn.004a1ec0
lea edi, [esp + 0x50]
lea esi, [esp]
call fcn.00464c5e
lea edi, [esp]
lea esi, [esp + 0x50]
call fcn.00464c5e
mov dword [esp + 0x18], 0xfffffffe
mov dword [esp + 0x14], 0xd5fa0e00
call fcn.004a1480
lea edi, [esp + 0x78]
lea esi, [esp + 0x1c]
call fcn.00464c5e
mov eax, dword [esp + 0x94]
lea esi, [eax + 0x10]
mov dword [esp + 0x3c], esi
lea edi, [esp + 0x64]
call fcn.00464c5e
lea edi, [esp]
lea esi, [esp + 0x64]
call fcn.00464c5e
lea edi, [esp + 0x14]
lea esi, [esp + 0x78]
call fcn.00464c5e
call fcn.004a0000
movzx eax, byte [esp + 0x28]
test al, al
jne 0x4cf3c5
mov eax, dword [0x652970]
test eax, eax
jne 0x4cf31f
mov edi, dword [esp + 0x3c]
lea esi, [esp + 0x50]
call fcn.00464c5e
jmp 0x4cf33d
lea eax, [0x535ac0]
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
lea eax, [esp + 0x50]
mov dword [esp + 8], eax
call fcn.00410320
mov eax, dword [esp + 0x98]
mov dword [esp], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 4], eax
call fcn.004d1df0
mov eax, dword [esp + 8]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x94]
lea edx, [ecx + 0x24]
mov dword [esp + 0x38], edx
mov dword [esp], edx
call fcn.0046c4c0
mov eax, dword [0x652970]
test eax, eax
jne 0x4cf38f
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x94]
mov dword [ecx + 0x3c], eax
jmp 0x4cf3a2
mov ecx, dword [esp + 0x94]
lea edi, [ecx + 0x3c]
mov eax, dword [esp + 0x34]
call fcn.00464560
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.0046c550
mov byte [esp + 0x33], 0
mov edx, dword [esp + 0x8c]
mov eax, dword [edx]
call eax
add esp, 0x90
ret
mov byte [esp + 0x33], 0
mov edx, dword [esp + 0x8c]
mov eax, dword [edx]
call eax
add esp, 0x90
ret
add esp, 0x90
ret
call fcn.00463190
jmp fcn.004cf1c0
Function at 0x4d9f70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4da0d1
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x4d9ff7
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
jne 0x4d9ffb
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x4d9fc1
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x4d9ffb
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x4da003
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], edx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call fcn.004d9d50
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call fcn.004e0570
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
mov dword [esp + 0x80], edx
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], ecx
add esp, 0x48
ret
call fcn.00463190
jmp fcn.004d9f70
Function at 0x4fed20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4fee4a
sub esp, 0xc
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4feda3
mov edx, dword [esp + 0x1c]
cmp edx, ecx
jb 0x4fee44
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
cmp edx, ebx
je 0x4fed7a
nop
mov ebp, ebx
lea esi, [edx + ecx - 1]
cmp esi, ebx
jb 0x4fed78
mov ebx, edx
lea esi, [ebp + ecx - 1]
cmp esi, edx
jae 0x4fee2c
mov edx, ebx
mov ebx, ebp
jmp 0x4fed7a
mov ebx, ebp
mov ebp, dword [esp + 0x10]
movzx esi, byte [ebp + 0x400]
movzx edi, byte [ebp + 0x401]
lea eax, [ecx - 1]
mov ebx, dword [esp + 0x18]
cmp ebx, eax
jbe 0x4fee25
mov ebx, dword [esp + 0x14]
xor eax, eax
jmp 0x4fedc3
add esp, 0xc
ret
mov edx, dword [esp + 0x14]
mov byte [edx + eax], bl
inc eax
mov ebx, dword [esp + 0x20]
movzx esi, byte [esp + 0xb]
movzx edi, byte [esp + 0xa]
mov edx, ebx
mov ebx, dword [esp + 0x14]
cmp ecx, eax
jle 0x4fee0c
movzx edx, byte [edx + eax]
mov byte [esp + 9], dl
inc esi
xchg esi, eax
mov byte [esp + 0xb], al
xchg esi, eax
xchg esi, eax
movzx eax, al
xchg esi, eax
mov ebx, dword [ebp + esi*4]
add edi, ebx
xchg edi, eax
mov byte [esp + 0xa], al
xchg edi, eax
xchg edi, eax
movzx eax, al
xchg edi, eax
mov edx, dword [ebp + edi*4]
mov dword [ebp + esi*4], edx
mov dword [ebp + edi*4], ebx
add edx, ebx
movzx edx, dl
movzx ebx, byte [esp + 9]
xor ebx, dword [ebp + edx*4]
cmp ecx, eax
ja 0x4feda7
jmp 0x4fee20
xchg esi, eax
mov byte [ebp + 0x400], al
xchg esi, eax
xchg edi, eax
mov byte [ebp + 0x401], al
xchg edi, eax
add esp, 0xc
ret
call fcn.004645e0
mov ecx, ebx
call fcn.004645e0
lea eax, [0x51eb60]
mov dword [esp], eax
lea eax, [0x56e1ec]
mov dword [esp + 4], eax
call fcn.00436fe0
call fcn.00464620
nop
call fcn.00463190
jmp fcn.004fed20

Function at 0x4ff810
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4ff8b8
mov eax, dword [esp + 4]
movzx ecx, byte [eax + 0x6c]
test cl, cl
je 0x4ff86b
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
jmp 0x4ff8a2
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
ret
call fcn.00463190
jmp fcn.004ff810
Function at 0x502c10
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x502e26
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0xcc]
cmp ecx, 6
jne 0x502ca9
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
jmp 0x502e07
cmp ecx, 0xe
jne 0x502d22
mov dword [eax], 0x19544da2
mov dword [eax + 4], 0x8c3d37c8
mov dword [eax + 8], 0x89dcd4d6
mov dword [eax + 0xc], 0x73e19966
mov dword [eax + 0x10], 0x32ff9c82
mov dword [eax + 0x14], 0x1dfab7ae
mov dword [eax + 0x18], 0x582f9fcf
mov dword [eax + 0x1c], 0x679dd514
mov dword [eax + 0x20], 0x7bd44da8
mov dword [eax + 0x24], 0xf6d2b69
mov dword [eax + 0x28], 0x4c48942
mov dword [eax + 0x2c], 0x77e36f73
mov dword [eax + 0x30], 0x6a1d36c8
mov dword [eax + 0x34], 0x3f9d85a8
mov dword [eax + 0x38], 0x91d692a1
mov dword [eax + 0x3c], 0x1112e6ad
jmp 0x502e07
cmp ecx, 0xf
jne 0x502d98
mov dword [eax], 0xfc2bf72c
mov dword [eax + 4], 0x22312194
mov dword [eax + 8], 0xc84c64c2
mov dword [eax + 0xc], 0x9f555fa3
mov dword [eax + 0x10], 0x6f53b151
mov dword [eax + 0x14], 0x2393b86b
mov dword [eax + 0x18], 0x5940eabd
mov dword [eax + 0x1c], 0x96387719
mov dword [eax + 0x20], 0xa88effe3
mov dword [eax + 0x24], 0x96283ee2
mov dword [eax + 0x28], 0x53863992
mov dword [eax + 0x2c], 0xbe5e1e25
mov dword [eax + 0x30], 0x2c85b8aa
mov dword [eax + 0x34], 0x2b0199fc
mov dword [eax + 0x38], 0x81c52ca2
mov dword [eax + 0x3c], 0xeb72ddc
jmp 0x502e07
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0xc0], 0
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
ret
call fcn.00463190
jmp fcn.00502c10
Function at 0x507e20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x507fae
sub esp, 0x58
lea eax, [0x527bc0]
mov dword [esp], eax
call fcn.0040b6d0
mov eax, dword [esp + 4]
mov dword [esp + 0x24], eax
lea edi, [esp + 0x28]
xor eax, eax
call fcn.00464774
movzx eax, word [esp + 0x5c]
mov word [esp], ax
call fcn.00408f30
mov eax, dword [esp + 4]
lea ecx, [0x51ec60]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
lea eax, [0x51ed20]
mov dword [esp + 0x30], eax
movzx edx, byte [esp + 0x5e]
movzx edx, dl
lea ebx, [0x6201a0]
lea edx, [ebx + edx*8]
mov dword [esp + 0x34], edx
movzx edx, word [esp + 0x60]
mov word [esp], dx
call fcn.00408f30
mov eax, dword [esp + 4]
lea ecx, [0x51ec60]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
lea eax, [0x51ed20]
mov dword [esp + 0x40], eax
movzx eax, byte [esp + 0x62]
movzx eax, al
lea edx, [0x6201a0]
lea eax, [edx + eax*8]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x68]
mov word [esp], ax
call fcn.00408f30
mov eax, dword [esp + 4]
lea ecx, [0x51ec60]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x64]
mov dword [esp], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 8], eax
call fcn.00409130
mov eax, dword [esp + 0xc]
lea ecx, [0x51aba0]
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], eax
xor eax, eax
jmp 0x507f6d
mov dword [esp + 0x20], eax
lea ecx, [esp + eax*8 + 0x28]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
lea ebx, [0x56e5a4]
mov dword [esp], ebx
mov ebp, dword [esp + 0x24]
mov dword [esp + 4], ebp
lea esi, [0x56eca8]
mov dword [esp + 8], esi
lea edi, [0x6527d8]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
call fcn.00482520
mov eax, dword [esp + 0x20]
inc eax
cmp eax, 6
jl 0x507f29
mov edx, dword [esp + 0x24]
mov ecx, dword [edx + 4]
mov ebx, dword [edx]
mov ebp, dword [edx + 8]
mov eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x507fa8
sub ebp, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and ebp, eax
add ebx, ebp
mov dword [esp + 0x70], ebx
sub ecx, eax
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x58
ret
call fcn.00464640
nop
call fcn.00463190
jmp fcn.00507e20
Function at 0x50dbf0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x50dd40
sub esp, 0x40
mov eax, 0
mov dword [esp + 0x3c], eax
mov byte [esp + 0x23], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
lea eax, [0x50dd50]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x3c], eax
mov byte [esp + 0x23], 1
lea eax, [0x51ed20]
mov dword [esp], eax
mov dword [esp + 4], 0xffff
mov dword [esp + 8], 0xffff
call fcn.0044b8b0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], eax
jmp 0x50dcd9
mov eax, dword [esp + 0x44]
movzx edx, word [eax + 8]
movzx ebx, byte [eax + 6]
movzx ebp, word [eax + 4]
mov word [esp], dx
mov byte [esp + 2], bl
mov word [esp + 4], bp
mov byte [esp + 6], 0
mov edx, dword [esp + 0x24]
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 0xffff
call fcn.00507e20
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
mov eax, dword [esp + 0x50]
mov dword [esp], eax
lea ecx, [esp + 0x30]
mov dword [esp + 4], ecx
call fcn.004048a0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x48]
mov edx, dword [ecx + 0x18]
mov ebx, dword [esp + 0x4c]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xffff
mov dword [esp + 0xc], 0xffff
call edx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x50dd1b
test ecx, ecx
jle 0x50dd1b
cmp ecx, 0xffff
jbe 0x50dc6e
jmp 0x50dd2c
mov byte [esp + 0x23], 0
mov edx, dword [esp + 0x3c]
mov eax, dword [edx]
call eax
add esp, 0x40
ret
mov edx, 0xffff
call fcn.00464620
nop
call fcn.00436460
add esp, 0x40
ret
call fcn.00463190
jmp fcn.0050dbf0
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x6e77d0
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x42e1d0
mov ecx, 0x9d65354
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40563b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40a020]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402fd6
and dword [ebp - 0x14], 0
cmp dword [0x40b7d8], 0
mov dword [ebp - 0x18], eax
jne 0x4056ee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405796
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405796
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40b7d8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40b7dc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40b7e0], eax
call edi
push eax
call esi
mov dword [0x40b7e8], eax
test eax, eax
je 0x4056ee
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40b7e4], eax
mov eax, dword [0x40b7e4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405747
cmp dword [0x40b7e8], ecx
je 0x405747
push eax
call esi
push dword [0x40b7e8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405747
test ebx, ebx
je 0x405747
call edi
test eax, eax
je 0x40573e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40573e
test byte [ebp - 8], 1
jne 0x405747
or dword [ebp + 0x10], 0x200000
jmp 0x40577a
mov eax, dword [0x40b7dc]
cmp eax, dword [ebp - 0x18]
je 0x40577a
push eax
call esi
test eax, eax
je 0x40577a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40577a
mov eax, dword [0x40b7e0]
cmp eax, dword [ebp - 0x18]
je 0x40577a
push eax
call esi
test eax, eax
je 0x40577a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40b7d8]
call esi
test eax, eax
je 0x405796
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405798
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040239a
leave
ret

Function at 0x40891a
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
dec eax
mov eax, 0x7e328542
call fcn.0040894a
mov edx, 0xe5355bcd
xor dword [ecx], ebx
add ecx, 1
add edx, edx
cmp ecx, edi
jne fcn.0040891a
sub eax, 0xd3c0347
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0xd8748c2
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x62082848
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40de38
nop
mov ecx, 0x683d4e6f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x42513550
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x10012e3a
Capabilities:
Create process on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10012e5a
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10012e58
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x10012e67
push 0x1ce9
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret
Function at 0x1001c4ac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001c4de
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1001c4eb
push 0x1ce9
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret
Function at 0x1001d404
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001d423
push 0x1204
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x1001d46e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001d451
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001d46e
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10015e0b
mov dword [eax], 0xf14186e1
jmp 0x1001d446
mov esp, ebp
pop ebp
ret
Function at 0x10026c7d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10026c90
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x10026c9d
push 0x1ce9
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
pop ebp
ret

Function at 0x100278b3
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100278e7
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov eax, dword [eax]
add eax, dword [ecx + 4]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
mov dword [ecx], eax
jmp 0x10027925
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10027909
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xc
jge 0x10027925
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10027923
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x100278fe
mov esp, ebp
pop ebp
ret