joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022d79
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp byte [ebp + 0x18], 0
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], edx
push edi
mov dword [ebp - 0xc], ebx
je 0x10022ec8
mov dword [ebp - 8], 0x2358
cmp dword [ebp - 8], 0x23fe
push 0
pop edi
jle 0x10022e01
mov esi, edi
mov ebx, edi
mov ecx, edi
mov dword [ebp + 0x18], edi
mov eax, ebx
shl eax, cl
lea ecx, [ebp - 0x24]
and eax, esi
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10022dcb
mov eax, dword [eax]
push eax
call fcn.10047e1c
pop ecx
push edi
push 1
lea ecx, [ebp - 0x24]
call fcn.10004d0a
mov ecx, dword [ebp + 0x18]
inc ecx
mov dword [ebp + 0x18], ecx
cmp ecx, 0x3e7a
jl 0x10022db0
inc ebx
cmp ebx, 0x3b38
jl 0x10022dab
inc esi
cmp esi, 0x2923
jl 0x10022da9
mov ebx, dword [ebp - 0xc]
cmp dword [ebp - 8], 0x225a
jge 0x10022e15
push str.gdiejjv_wpogpi_veurt_lhr_kuker_qrb_bos_qhckmdx
call fcn.10047e1c
pop ecx
cmp byte [ebp + 0xc], 0
je 0x10022e27
push edi
call dword [sym.imp.USER32.dll_DestroyCursor]
jmp 0x10022f00
mov esi, dword [ebp + 0x24]
xor ecx, ecx
mov eax, dword [esi]
mov eax, dword [esi]
cmp eax, 0xe8fe
mov eax, dword [ebp - 4]
setg cl
xor edx, edx
mov eax, dword [eax]
cmp ecx, eax
mov eax, dword [esi]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp + 0x10]
setl cl
sub ecx, 0xfffc
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [eax], ecx
mov eax, dword [eax]
mov ecx, dword [ebp + 0x20]
mov dword [ecx], eax
mov ecx, dword [ecx]
mov eax, dword [esi]
cmp eax, ecx
mov eax, dword [ebp - 4]
sete dl
xor ecx, ecx
mov eax, dword [eax]
cmp edx, eax
mov eax, dword [ebp - 4]
setl cl
xor edx, edx
mov eax, dword [eax]
cmp ecx, eax
mov eax, dword [esi]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 4]
setle cl
xor edx, edx
mov eax, dword [eax]
cmp ecx, eax
mov eax, dword [esi]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esi]
setl cl
sub ecx, eax
mov eax, dword [esi]
add eax, ecx
jne 0x10022eb6
mov eax, dword [ebp + 0x20]
cmp dword [eax], edi
je 0x10022eb9
xor edi, edi
inc edi
xor eax, eax
cmp edi, 0x2c5d177c
setne al
mov dword [ebx], eax
jmp 0x10022f00
cmp byte [ebp + 0x1c], 0
je 0x10022ef3
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10022f00
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x7520
inc dword [edx]
cmp dword [edx], 3
jl 0x10022edf
jmp 0x10022f00
push 0xa82
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002394d
Capabilities:
Resume thread

Disassembly:
mov eax, 0x10061395
call fcn.10060138
sub esp, 0x14
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10023980
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1002396f
mov dword [ebp - 0x1c], 0x476a
cmp dword [ebp - 0x1c], 0x4923
jle 0x100239e7
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov eax, ebx
cdq
idiv ecx
mov ecx, edi
mov eax, esi
sub ecx, edx
shl eax, cl
mov ecx, 0x1007cb98
cdq
push edx
push eax
call fcn.10004616
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x7f54
jl 0x100239a3
inc ebx
cmp ebx, 0xa1e
jl 0x1002399e
inc edi
cmp edi, 0x10c1
jl 0x1002399c
inc esi
cmp esi, 0x1b47
jl 0x1002399a
push 0x3239
push 0x2d75
push 0x63b1
push 1
push 0
mov edx, 0x250a
xor cl, cl
call fcn.10023b3a
and dword [ebp - 4], 0
add esp, 0x14
cmp dword [ebp - 0x1c], 0x45fa
jge 0x1002396f
mov edx, str.qpp_edfk_hwjpwpgn_rgurncx_pjxofes_pzpfztr_msup
mov ecx, 0x1007cb98
call fcn.10006a66
jmp 0x1002396f

Function at 0x10023cf9
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 8], cl
test cl, cl
je 0x10023d3e
cmp byte [edx], 0
je 0x10023d4e
push 0xa4
push 0x4b75
push 0
push 0
push 0x4cb6
push 0x5e78
push 1
push 0x71ac
mov edx, 0x4a32
mov ecx, 0x43ed
call fcn.10022d79
add esp, 0x20
jmp 0x10023d4e
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x10023d4e
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esp, ebp
pop ebp
ret
Function at 0x100245c0
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x100613d1
call fcn.10060138
sub esp, 0x34
mov byte [ebp - 0x14], dl
push ebx
mov ebx, ecx
mov dword [ebp - 0x24], ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1002467c
mov dword [ebp - 0x1c], 0x208d
cmp dword [ebp - 0x1c], 0x20f0
jle 0x10024655
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov ecx, edi
mov dword [ebp - 0x20], esi
xor ebx, ebx
sar esi, cl
mov ecx, ebx
mov eax, esi
sar eax, cl
lea ecx, [ebp - 0x3c]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002461e
mov eax, dword [eax]
push eax
call fcn.10047e1c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.10004d0a
inc ebx
cmp ebx, 0x42c3
jl 0x10024603
mov esi, dword [ebp - 0x18]
inc edi
cmp edi, 0x7f1f
jl 0x100245fa
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x931
jl 0x100245f8
mov ebx, dword [ebp - 0x24]
cmp dword [ebp - 0x1c], 0x1f94
jge 0x10024669
push str.esd_nltygprh_xptpsu_nncft_emdbejnyz
call fcn.10047e1c
pop ecx
inc dword [ebx]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x4279
cmp dword [ebp - 0x1c], 0x44f6
jle 0x100246b3
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x1007cb98
or eax, esi
cdq
push edx
push eax
call fcn.10004616
inc edi
cmp edi, 0x7cf8
jl 0x10024690
inc esi
cmp esi, 0x6320
jl 0x1002468e
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x421e
jge 0x1002466b
mov edx, str.fsxrblb_lozn_eaynlu_abt_thpivgz_snxqhmarq_jljyzfqhx_ehxuwzdk_gda_bxggh_yyraafus_fnlnpn_dufmkuz
mov ecx, 0x1007cb98
call fcn.10006a66
jmp 0x1002466b

Function at 0x10025e4d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp byte [ebp + 0x14], 0
push ebx
push edi
je 0x10025e78
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10025ef8
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
jmp 0x10025ef8
mov dword [ebp - 0xc], 0x761c
cmp dword [ebp - 0xc], 0x7906
jle 0x10025ed7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edi, edi
mov dword [ebp - 8], edi
mov ebx, edi
mov edi, 0x371f
mov eax, ebx
lea ecx, [ebp - 0x24]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10025eb1
mov eax, dword [eax]
push eax
call fcn.10047e1c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x24]
call fcn.10004d0a
dec ebx
dec edi
jne 0x10025e9a
mov edi, dword [ebp - 8]
inc edi
mov dword [ebp - 8], edi
cmp edi, 0x5c0
jl 0x10025e93
push 0xa82
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp dword [ebp - 0xc], 0x7595
jge 0x10025ef8
push str.kqzm_kibixe_lwyuhok
call fcn.10047e1c
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100264de
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
mov edx, ecx
je 0x1002650d
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10026515
push esi
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 7
inc dword [edx]
cmp dword [edx], 2
jl 0x100264f8
pop esi
pop ebp
ret
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
pop ebp
ret

Function at 0x100269d3
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 8], cl
test cl, cl
je 0x100269fc
push 1
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push eax
mov dl, 1
push 0x360e
mov cl, dl
call fcn.100237a0
add esp, 0xc
jmp 0x10026a0e
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10026a0e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov esp, ebp
pop ebp
ret
Function at 0x1002b9e7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006168e
call fcn.10060138
sub esp, 0x10
push ebx
push esi
mov dword [ebp - 0x18], 0x6249
mov esi, ecx
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x18], 0x64dd
mov dword [ebp - 0x14], esi
jle 0x1002ba42
mov edi, ebx
mov esi, ebx
mov eax, esi
mov ecx, 0x1007cb98
xor eax, edi
cdq
push edx
push eax
call fcn.10004616
inc esi
cmp esi, 0x17f0
jl 0x1002ba15
inc edi
cmp edi, 0x607e
jl 0x1002ba13
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x600a
jge 0x1002ba5d
mov edx, str.nnaliomi_lxfctm_yldmqzsxn_fphc_dqrnzahz_ryrcini_uayav_aqzacwvi_fbsoexjzj_kgxlzl
mov ecx, 0x1007cb98
call fcn.10006a66
or dword [ebp - 4], 0xffffffff
mov eax, dword [esi + 0x10]
mov ecx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
test eax, eax
je 0x1002bab1
cmp eax, ebx
jbe 0x1002baec
cmp dword [esi + 0x14], 8
jb 0x1002ba7c
mov esi, dword [esi]
movzx esi, word [esi + ebx*2]
lea edx, [ebx - 0x5e27]
mov ecx, esi
call fcn.100414d4
movzx edi, ax
xor edx, edx
lea eax, [ebx + esi]
mov esi, dword [ebp - 0x14]
push 0x19
pop ecx
div ecx
mov eax, dword [ebp - 0x1c]
mov ecx, edx
shl edi, cl
mov ecx, dword [ebp - 0x18]
add ecx, edi
inc ebx
mov dword [ebp - 0x18], ecx
cmp ebx, eax
jb 0x1002ba70
pop edi
mov eax, ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push str.TrsVuQyNJNTtVeFWigXKldr
call fcn.1004320f
int3
Function at 0x1003039e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100617a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100304a1
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x2c8c
mov dword [ebp - 0x28], str.gfr_ogda_xghda_nswnoows_xkf
cmp dword [ebp - 0x20], 0x2f78
jle 0x1003044d
push 0
push 0x1c99
call dword [sym.imp.GDI32.dll_SetLayout]
and dword [ebp - 0x18], 0
jmp 0x10030403
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x34af
jge 0x10030443
and dword [ebp - 0x1c], 0
jmp 0x10030419
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x63f2
jge 0x10030441
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov ecx, 0x1007cb98
call fcn.10004616
jmp 0x10030412
jmp 0x100303fc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x24]
push 1
push 0x5399
call fcn.10030525
add esp, 0xc
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x2be8
jge 0x10030479
mov edx, dword [ebp - 0x28]
mov ecx, 0x1007cb98
call fcn.10006a66
jmp 0x10030495
or dword [ebp - 4], 0xffffffff
jmp 0x1003049f
jmp 0x10030514
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x100304cc
push 0xa82
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x10030514
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x100304fa
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 3
jge 0x10030514
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x40]
call fcn.100048b9
or dword [eax], 0xffffffff
jmp 0x100304ef
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4010f7
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x403020]
push esi
mov dword [ebp + 0x74], eax
mov esi, ecx
call fcn.004010c7
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR71.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x401159
cmp dword [ebp - 0x1c], 5
jb 0x401171
jmp 0x40116d
cmp dword [ebp - 0x10], 1
jne 0x401171
cmp dword [ebp - 0x1c], 4
ja 0x40116d
jne 0x401171
cmp dword [ebp - 0x18], 0
jbe 0x401171
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x710
mov dword [esi + 0x14], 0x40213c
call fcn.00401030
test eax, eax
jge 0x401192
mov byte [0x403034], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
pop esi
call fcn.004011d3
add ebp, 0x78
leave
ret
Function at 0x4077d0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x4077f5
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x407868
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x40782a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x40785d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x40785b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x407821
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x4077ec
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x10005620
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
mov edx, dword [ebp + 8]
mov al, byte [ecx + str.cw]
mov byte [edx], al
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp + 8]
mov al, byte [eax + str.cw]
mov byte [edx + ecx], al
mov ecx, 1
shl ecx, 1
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
mov ecx, 1
shl ecx, 1
mov edx, dword [ebp + 8]
mov al, byte [eax + str.cw]
mov byte [edx + ecx], al
mov ecx, 1
imul edx, ecx, 3
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
mov edx, 1
imul eax, edx, 3
mov edx, dword [ebp + 8]
mov cl, byte [ecx + str.cw]
mov byte [edx + eax], cl
mov edx, 1
shl edx, 2
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
mov edx, 1
shl edx, 2
mov eax, dword [ebp + 8]
mov cl, byte [ecx + str.cw]
mov byte [eax + edx], cl
mov edx, 1
imul eax, edx, 5
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
mov eax, 1
imul ecx, eax, 5
mov eax, dword [ebp + 8]
mov dl, byte [edx + str.cw]
mov byte [eax + ecx], dl
mov eax, 1
imul ecx, eax, 6
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
mov ecx, 1
imul edx, ecx, 6
mov ecx, dword [ebp + 8]
mov al, byte [eax + str.cw]
mov byte [ecx + edx], al
mov ecx, 1
imul edx, ecx, 7
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
mov edx, 1
imul eax, edx, 7
mov edx, dword [ebp + 8]
mov cl, byte [ecx + str.cw]
mov byte [edx + eax], cl
mov edx, 1
shl edx, 3
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
mov edx, 1
shl edx, 3
mov eax, dword [ebp + 8]
mov cl, byte [ecx + str.cw]
mov byte [eax + edx], cl
mov edx, 1
imul eax, edx, 9
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
mov eax, 1
imul ecx, eax, 9
mov eax, dword [ebp + 8]
mov dl, byte [edx + str.cw]
mov byte [eax + ecx], dl
mov eax, 1
imul ecx, eax, 0xa
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
mov ecx, 1
imul edx, ecx, 0xa
mov ecx, dword [ebp + 8]
mov al, byte [eax + str.cw]
mov byte [ecx + edx], al
mov ecx, 1
imul edx, ecx, 0xb
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
mov edx, 1
imul eax, edx, 0xb
mov edx, dword [ebp + 8]
mov cl, byte [ecx + str.cw]
mov byte [edx + eax], cl
mov edx, 1
imul eax, edx, 0xc
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
mov eax, 1
imul ecx, eax, 0xc
mov eax, dword [ebp + 8]
mov dl, byte [edx + str.cw]
mov byte [eax + ecx], dl
mov eax, 1
imul ecx, eax, 0xd
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
mov ecx, 1
imul edx, ecx, 0xd
mov ecx, dword [ebp + 8]
mov al, byte [eax + str.cw]
mov byte [ecx + edx], al
mov ecx, 1
imul edx, ecx, 0xe
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
mov edx, 1
imul eax, edx, 0xe
mov edx, dword [ebp + 8]
mov cl, byte [ecx + str.cw]
mov byte [edx + eax], cl
mov edx, 1
imul eax, edx, 0xf
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
mov eax, 1
imul ecx, eax, 0xf
mov eax, dword [ebp + 8]
mov dl, byte [edx + str.cw]
mov byte [eax + ecx], dl
pop ebp
ret
Function at 0x10047c10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x10047d1c
test eax, eax
je 0x10047d1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x10062fe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x10047d03
lea edi, [eax + 4]
jmp 0x10047c67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x10047c7c
mov dword [ebp - 4], 2
jmp 0x10047c9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x10047c93
mov dword [ebp - 4], 1
jmp 0x10047c9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x10047d13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x10047cd6
mov byte [ecx], 0x3d
jmp 0x10047ce2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x10047ced
mov byte [ecx], 0x3d
jmp 0x10047cf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x10047c64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4286af
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4478e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x428723
push 0x228
lea eax, [ebp - 0x22c]
push edi
push eax
mov dword [ebp - 0x230], 0x22c
call fcn.00433a50
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x42871c
lea eax, [ebp - 0x230]
push eax
push esi
inc edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x428705
cmp edi, 0x3c
jg 0x428723
push 1
call fcn.004343d9
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00432e69
leave
ret
Function at 0x432e69
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4478e0]
jne 0x432e73
repz ret
jmp fcn.00435aac

Function at 0x43bd97
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4478e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004354a5
and dword [ebp - 0x14], 0
cmp dword [0x44ba00], 0
mov dword [ebp - 0x18], eax
jne 0x43be4a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x43bef2
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x442f64
push ebx
call edi
test eax, eax
je 0x43bef2
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44ba00], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44ba04], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44ba08], eax
call edi
push eax
call esi
mov dword [0x44ba10], eax
test eax, eax
je 0x43be4a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44ba0c], eax
mov eax, dword [0x44ba0c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x43bea3
cmp dword [0x44ba10], ecx
je 0x43bea3
push eax
call esi
push dword [0x44ba10]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x43bea3
test ebx, ebx
je 0x43bea3
call edi
test eax, eax
je 0x43be9a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x43be9a
test byte [ebp - 8], 1
jne 0x43bea3
or dword [ebp + 0x10], 0x200000
jmp 0x43bed6
mov eax, dword [0x44ba04]
cmp eax, dword [ebp - 0x18]
je 0x43bed6
push eax
call esi
test eax, eax
je 0x43bed6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x43bed6
mov eax, dword [0x44ba08]
cmp eax, dword [ebp - 0x18]
je 0x43bed6
push eax
call esi
test eax, eax
je 0x43bed6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44ba00]
call esi
test eax, eax
je 0x43bef2
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x43bef4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00432e69
leave
ret