joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4abac0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x5cb548]
mov ecx, dword [0x5cb544]
push ebp
push esi
push edi
push eax
push ecx
call fcn.0049bf00
mov edx, dword [0x5cb548]
push edx
call fcn.0049c960
add esp, 0xc
test eax, eax
je 0x4abc45
mov eax, dword [0x5f3ff8]
mov ebp, dword [sym.imp.kernel32.dll_FreeLibrary]
test eax, eax
mov dword [0x5f3ff4], 1
je 0x4abb08
push eax
call ebp
mov edi, dword [sym.imp.kernel32.dll_LoadLibraryA]
push 0x5cb5c0
call edi
test eax, eax
mov dword [0x5f3ff8], eax
jne 0x4abb27
pop edi
pop esi
mov eax, 0x80000b10
pop ebp
ret
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push 0x5cb5b8
push eax
call esi
test eax, eax
jne 0x4abb42
pop edi
pop esi
mov eax, 0x80000b10
pop ebp
ret
mov dword [0x5fe810], eax
mov eax, dword [0x5f3ff8]
push 0x5cb5ac
push eax
call esi
test eax, eax
jne 0x4abb61
pop edi
pop esi
mov eax, 0x80000b10
pop ebp
ret
mov ecx, dword [0x5f3ff8]
push 0x5cb5a0
push ecx
mov dword [0x5fe80c], eax
call esi
test eax, eax
jne 0x4abb81
pop edi
pop esi
mov eax, 0x80000b10
pop ebp
ret
mov edx, dword [0x5f3ff8]
push 0x5cb594
push edx
mov dword [0x5fe808], eax
call esi
test eax, eax
jne 0x4abba1
pop edi
pop esi
mov eax, 0x80000b10
pop ebp
ret
mov dword [0x5fe814], eax
mov eax, dword [0x5f4000]
test eax, eax
je 0x4abbb2
push eax
call ebp
push 0x5cb584
call edi
test eax, eax
mov dword [0x5f4000], eax
jne 0x4abbcb
pop edi
pop esi
mov eax, 0x80000a00
pop ebp
ret
push 0x5cb56c
push eax
call esi
test eax, eax
jne 0x4abbe0
pop edi
pop esi
mov eax, 0x80000a02
pop ebp
ret
mov dword [0x5fe870], eax
mov eax, dword [0x5f4000]
push 0x5cb558
push eax
call esi
test eax, eax
jne 0x4abbff
pop edi
pop esi
mov eax, 0x80000a03
pop ebp
ret
mov dword [0x5fe874], eax
call dword [0x5fe870]
xor ecx, ecx
mov cl, ah
cmp cl, 1
jne 0x4abc26
pop edi
pop esi
mov dword [0x5f3ffc], 1
and eax, 0xff
pop ebp
ret
mov eax, dword [0x5f4000]
test eax, eax
je 0x4abc32
push eax
call ebp
pop edi
pop esi
mov dword [0x5f3ffc], 0
mov eax, 0x80000a04
pop ebp
ret
pop edi
pop esi
mov dword [0x5f3ff4], 0
mov eax, 0x80000a01
pop ebp
ret
Function at 0x4acf60
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x5cb548]
mov ecx, dword [0x5cb544]
sub esp, 0x10
push eax
push ecx
call fcn.0049bf00
mov edx, dword [0x5cb548]
push edx
call fcn.0049ca20
add esp, 0xc
test eax, eax
je 0x4acff8
lea eax, [esp]
push eax
push 0x20019
push 0
push 0x5cb6fc
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4acfd3
lea ecx, [esp + 8]
lea edx, [esp + 4]
push ecx
mov ecx, dword [esp + 4]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0x5cb6f4
push ecx
mov dword [esp + 0x20], 4
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
jmp 0x4acfdb
mov dword [esp + 4], 0
mov edx, dword [esp]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [esp + 4]
mov dword [0x5f4010], 1
add esp, 0x10
ret
or eax, 0xffffffff
add esp, 0x10
ret
Function at 0x4ad2c0
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x10
mov edx, dword [esp + 0x1c]
push ebp
mov ecx, edx
push esi
mov esi, dword [esp + 0x20]
mov ebp, ecx
push edi
xor eax, eax
mov edi, esi
mov dword [esp + 0xc], 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebp
and ecx, 3
rep stosb byte es:[edi], al
xor eax, eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
push eax
push ecx
push edx
push esi
lea edx, [esp + 0x20]
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
push 0xc
push edx
push 0x2d1400
push eax
call dword [sym.imp.kernel32.dll_DeviceIoControl]
neg eax
sbb eax, eax
pop edi
and eax, 0xc
pop esi
add eax, 0xfffffff4
pop ebp
add esp, 0x10
ret

Function at 0x4ad330
Capabilities:
Get disk information

Disassembly:
sub esp, 0x40
push ebx
mov ebx, dword [sym.imp.kernel32.dll_CreateFileA]
push ebp
mov ebp, dword [esp + 0x4c]
push esi
push edi
xor edi, edi
mov esi, 0x41
push esi
lea eax, [esp + 0x14]
push 0x5cb5d8
push eax
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.kernel32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x4ad3ab
push 0
push 0
push 3
push 0
push 3
lea edx, [esp + 0x24]
push 0x80000000
push edx
mov byte [esp + 0x32], 0
call ebx
cmp eax, 0xffffffff
je 0x4ad3cb
push ebp
push eax
mov eax, dword [esp + 0x1c]
push eax
call fcn.004ad000
add esp, 0xc
test eax, eax
jl 0x4ad3c3
mov eax, dword [esp + 0x58]
inc edi
add ebp, 0x7c
cmp edi, eax
je 0x4ad3b1
inc esi
cmp esi, 0x5a
jle 0x4ad348
mov ecx, dword [esp + 0x54]
mov dword [0x5f400c], edi
mov dword [0x5f4004], ecx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
pop edi
pop esi
pop ebp
mov eax, 0xfffffff5
pop ebx
add esp, 0x40
ret
Function at 0x4ada80
Capabilities:
Get disk information
Query or enumerate registry value

Disassembly:
sub esp, 0x30
mov eax, dword [0x5cb548]
mov ecx, dword [0x5cb544]
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push eax
push ecx
mov dword [esp + 0x18], ebx
call fcn.0049bf00
mov edx, dword [0x5cb548]
push edx
call fcn.0049c960
add esp, 0xc
test eax, eax
je 0x4adabf
pop edi
pop esi
pop ebp
mov eax, 0x80000c01
pop ebx
add esp, 0x30
ret
mov eax, dword [0x5cb548]
mov ebp, dword [sym.imp.user32.dll_wsprintfA]
mov edi, dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, 0x41
mov ecx, dword [eax + 4]
mov dword [0x5f3660], ecx
push esi
lea edx, [esp + 0x24]
push 0x5cb5d8
push edx
call ebp
add esp, 0xc
lea eax, [esp + 0x24]
mov byte [esp + 0x27], bl
push eax
call dword [sym.imp.kernel32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x4adb41
mov eax, dword [0x5f3660]
mov byte [esp + 0x26], bl
cmp eax, 4
jg 0x4adb19
xor eax, eax
mov ecx, 0x80000000
jmp 0x4adb23
mov eax, 3
mov ecx, 0xc0000000
push ebx
push ebx
push 3
push ebx
push eax
push ecx
lea ecx, [esp + 0x38]
push ecx
call edi
cmp eax, 0xffffffff
je 0x4adab2
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
inc esi
cmp esi, 0x5a
jle 0x4adade
lea edx, [esp + 0x14]
push edx
push 0x20019
push ebx
push 0x5cb6fc
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
cmp eax, ebx
mov dword [esp + 0x10], eax
jne 0x4adb94
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
push edx
push ebx
push 0x5cb6f4
push eax
mov dword [esp + 0x30], 4
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
jmp 0x4adb98
mov dword [esp + 0x10], ebx
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [0x5f4014], 1
pop ebx
add esp, 0x30
ret
Function at 0x4b1932
Capabilities:
Encode data using xor

Disassembly:
push 0x3942
jle 0x4b194b
add dword [esp], 0x4622a6
add dword [esp], 0x4bdc3
jmp 0x4b1943
ret
sub esp, 0x20
mov dword [esp + 0x1c], 0x6b10ef14
mov dword [esp + 0x18], 0x20030
mov dword [esp + 0x14], ebp
mov ebp, 0x4b1918
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], ebp
xor ebp, ebp
mov ebx, dword [esp + 0x1c]
mov ebx, dword [ebx]
xor ebp, ebx
add dword [esp + 0x1c], 4
dec word [esp + 0x18]
jne 0x4b1971
cmp ebp, 0x5c0
je 0x4b198e
int3
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
add esp, 0x20
add dword [esp], 0x47dee8
add dword [esp], 0x302c3
jmp 0x4b19a3
ret

Function at 0x4cbd35
Capabilities:
Encode data using xor

Disassembly:
pushfd
sub esp, 0x24
mov dword [esp + 0x20], 0x3419ef8f
mov dword [esp + 0x1c], 0xd21
mov dword [esp + 0x18], edx
mov edx, 0x4cbd04
ror dword [esp + 0x20], 0x18
mov dword [esp + 0x14], ebp
mov ebp, dword [edx]
add dword [esp + 0x20], ebp
add edx, 4
dec word [esp + 0x1c]
jne 0x4cbd5b
or byte [esp + 0x20], 1
mov edx, dword [esp + 0x20]
cmp edx, 0x266d
je 0x4cbd7d
int3
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x24], ebp
mov ebp, dword [esp + 0x14]
add esp, 0x20
popfd
jns 0x4cbdac
add dword [esp], 0x42d7da
add dword [esp], 0x9bfc3
jmp 0x4cbda5
ret
sub esp, 0x24
mov dword [esp + 0x20], 0x1f2435f7
mov dword [esp + 0x1c], 0x2007c
mov dword [esp + 0x18], ecx
mov ecx, 0x4cbd7c
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov edx, dword [esp + 0x20]
mov edx, dword [edx]
xor ecx, edx
add dword [esp + 0x20], 4
dec word [esp + 0x1c]
jne 0x4cbdd2
cmp ecx, 0x95
je 0x4cbdef
int3
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add esp, 0x24
add dword [esp], 0x408cde
add dword [esp], 0xc0bc3
jmp 0x4cbe04
ret

Function at 0x4cbe41
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0x81
push dword [esp]
sub dword [esp], 0x7e
push dword [esp]
xchg dword [esp], edx
mov edx, dword [edx]
sub esp, 0x20
mov dword [esp + 0x1c], 0x4833c607
mov dword [esp + 0x18], 0x2006b
mov dword [esp + 0x14], ecx
mov ecx, 0x4cbe10
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], ecx
xor ecx, ecx
Function at 0x4e0b80
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004e808b
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax - 1]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 4], 0
jne 0x4e0bc1
xor eax, eax
jmp 0x4e0c77
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004e6b30
add esp, 0xc
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x14]
jae 0x4e0c4a
mov edx, dword [ebp - 0x10]
push edx
call fcn.004e65a0
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x4e0bfa
jmp 0x4e0c4a
mov eax, dword [ebp - 0x18]
sub eax, 1
test eax, eax
jle 0x4e0c1c
mov ecx, dword [ebp - 0x18]
sub ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
call fcn.004e6e70
add esp, 0xc
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0xcc
je 0x4e0c39
mov edx, dword [ebp - 0x10]
xor eax, eax
mov al, byte [edx]
cmp eax, 0x90
jne 0x4e0c3f
mov ecx, dword [ebp - 0x10]
mov byte [ecx], 0
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x10], edx
jmp 0x4e0bdb
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 4]
push ecx
call fcn.004a9ec0
add esp, 0xc
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.004e8080
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4e26e0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f2d0c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x528
mov eax, dword [0x5f4b2c]
mov dword [ebp - 0x14], eax
cmp dword [0x5f4b24], 0
jne 0x4e2716
xor eax, eax
jmp 0x4e2833
mov ecx, dword [0x5f4b28]
shr ecx, 3
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
sub edx, 1
cmp dword [ebp - 0x14], edx
jl 0x4e2755
mov eax, dword [ebp - 0x24]
mov ecx, dword [0x5f4b24]
mov dword [ecx + eax*8 - 4], 0xfffffffd
mov edx, dword [ebp - 0x24]
mov eax, dword [0x5f4b24]
mov dword [eax + edx*8 - 8], 0xfffffffd
xor eax, eax
jmp 0x4e2833
mov ecx, dword [ebp - 0x14]
mov edx, dword [0x5f4b24]
mov eax, dword [ebp + 0xc]
mov dword [edx + ecx*8], eax
mov dword [ebp - 0x28], 0x5de110
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.004e2db0
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4e278b
xor eax, eax
jmp 0x4e2833
mov eax, dword [0x5f4b2c]
add eax, 1
mov dword [0x5f4b2c], eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0x5de120
lea edx, [ebp - 0x52c]
push edx
call fcn.00497b40
add esp, 0xc
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x534], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x534]
call fcn.00497b80
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x52c]
call fcn.00497b90
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], 0
push 2
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.004e2d20
add esp, 0x10
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
je 0x4e2830
push 2
call fcn.004e2d10
add esp, 4
xor eax, eax
jmp 0x4e2833
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ee892
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x5e1260
cmp edx, dword [eax]
je 0x4ee8b4
add eax, 8
inc ecx
cmp eax, 0x5e12f0
jl 0x4ee8a5
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x5e1260]
jne 0x4ee9e2
mov eax, dword [0x5f4be4]
cmp eax, 1
je 0x4ee9bc
test eax, eax
jne 0x4ee8e5
cmp dword [0x5dedf4], 1
je 0x4ee9bc
cmp edx, 0xfc
je 0x4ee9e2
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ee91c
lea eax, [ebp - 0x1a4]
push 0x5e3338
push eax
call fcn.004e6ed0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004e7020
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ee95f
lea eax, [ebp - 0x1a4]
push eax
call fcn.004e7020
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x5e3334
push edi
call fcn.004e7630
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x5e3318
push eax
call fcn.004e6ed0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004e6ee0
lea eax, [ebp - 0xa0]
push 0x5e3314
push eax
call fcn.004e6ee0
push dword [esi + 0x5e1264]
lea eax, [ebp - 0xa0]
push eax
call fcn.004e6ee0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x5e32ec
push eax
call fcn.004f0a4f
add esp, 0x2c
pop edi
jmp 0x4ee9e2
lea eax, [ebp + 8]
lea esi, [esi + 0x5e1264]
push 0
push eax
push dword [esi]
call fcn.004e7020
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
pop esi
leave
ret

Function at 0x42e002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x407ef8
nop
mov ecx, 0xa463b3e
nop
nop
nop
nop
nop
test eax, eax
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section._RDATA
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x1d743eab
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x347e8ffd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x347e900c
pop dword [ebp - 0x30]
mov eax, 0xff06fc3b
sub eax, 0xca886c2f
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xf21b045f
add dword [ebp - 0x40], 0x5c3740ec
mov dword [ebp - 0x3c], 0xe8ac4d6
sub dword [ebp - 0x3c], 0xdc577891
mov dword [ebp - 0x38], 0x756a6771
sub dword [ebp - 0x38], 0x291e2343
mov dword [ebp - 0x34], 0xf3fe84c4
add dword [ebp - 0x34], 0xc017b3c
lea eax, [ebp - 0x40]
push eax
mov eax, 0x32250bc2
sub eax, 0xfdadfad2
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x56118b04
add dword [ebp - 0x40], 0x1e60de52
mov dword [ebp - 0x3c], 0xf40ce39e
add dword [ebp - 0x3c], 0x4d5f7dd7
mov dword [ebp - 0x38], 0xb2628d0b
add dword [ebp - 0x38], 0xb10cdf61
mov dword [ebp - 0x34], 0xe48768d
add dword [ebp - 0x34], 0xf1b78973
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3a366
push 0
call eax
mov ecx, 0x8e249840
add ecx, 0x71dbbd21
xor esi, esi
add esi, eax
mov edx, 0x3985b50b
add edx, 0xfaf9baf5
add edx, dword [ebp - 0x30]
mov ebx, 0x9765e8f1
sub ebx, 0x458a87b
add dword [ebp - 0x1c], 0xadc4f040
mov edi, dword [edx]
xor dword [ebp - 0xc], ecx
sub edi, ebx
sub dword [ebp - 0x28], eax
mov dword [esi], edi
sub dword [ebp - 0x1c], esi
add esi, 4
add edx, 0x77753cbb
sub edx, 0x77753cb7
loop 0x347e912b
add eax, 0xdb2fd597
sub eax, 0xdb2e8d40
mov ebx, eax
add eax, 5
mov ecx, 0x7578f4d2
sub ecx, 0x4101f4d2
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x347ea89f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x347765c8]
jne 0x347eb289
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x347ee7f0], eax
mov dword [0x347ee7ec], ecx
mov dword [0x347ee7e8], edx
mov dword [0x347ee7e4], ebx
mov dword [0x347ee7e0], esi
mov dword [0x347ee7dc], edi
mov word [0x347ee808], ss
mov word [0x347ee7fc], cs
mov word [0x347ee7d8], ds
mov word [0x347ee7d4], es
mov word [0x347ee7d0], fs
mov word [0x347ee7cc], gs
pushfd
pop dword [0x347ee800]
mov eax, dword [ebp]
mov dword [0x347ee7f4], eax
mov eax, dword [ebp + 4]
mov dword [0x347ee7f8], eax
lea eax, [ebp + 8]
mov dword [0x347ee804], eax
mov eax, dword [ebp - 0x320]
mov dword [0x347ee740], 0x10001
mov eax, dword [0x347ee7f8]
mov dword [0x347ee6f4], eax
mov dword [0x347ee6e8], 0xc0000409
mov dword [0x347ee6ec], 1
mov eax, dword [0x347765c8]
mov dword [ebp - 0x328], eax
mov eax, dword [0x347ed254]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x347ee738], eax
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x3477694c
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x347ee738], 0
jne 0x347eb379
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x40ac26
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x418008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00404aad
mov dword [ebp - 0x14], eax
cmp dword [0x4314f0], esi
jne 0x40ad19
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40aca6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40adf9
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40adf9
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40adf9
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4314f0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4314f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4314f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x431500], eax
test eax, eax
je 0x40ad16
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4314fc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40ad3e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40ad31
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40ad53
push 4
pop eax
jmp 0x40adfb
cmp dword [ebp - 0x14], esi
je 0x40ad53
push dword [0x4314f0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40ad38
mov eax, dword [0x4314fc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40adb1
cmp dword [0x431500], edi
je 0x40adb1
push eax
call ebx
push dword [0x431500]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40adb1
test eax, eax
je 0x40adb1
call ecx
test eax, eax
je 0x40ada6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40ada6
test byte [ebp - 8], 1
jne 0x40adb1
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40ade1
mov eax, dword [0x4314f4]
cmp eax, edi
je 0x40adde
push eax
call ebx
test eax, eax
je 0x40adde
call eax
mov esi, eax
test esi, esi
je 0x40adde
mov eax, dword [0x4314f8]
cmp eax, edi
je 0x40adde
push eax
call ebx
test eax, eax
je 0x40adde
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4314f0]
call ebx
test eax, eax
je 0x40adf9
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40adfb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401728
mov esp, ebp
pop ebp
ret
Function at 0x40e5a6
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
mov eax, dword [0x418008]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
xor esi, esi
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [esp + 0x38]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
cmp esi, 0x3e6
jle 0x40e617
cmp dword [esp + 0xc], 0x1cecd011
je 0x40e617
cmp dword [esp + 0x34], 0x2090c5
je 0x40e617
cmp dword [esp + 0x58], 0x1d47b417
jne 0x40e622
add esi, 2
cmp esi, 0x1653e7d
jl 0x40e5bd
call fcn.0040e645
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x6c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.00401728
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40ffae
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push str.VirtualProtect
push dword [0x440f48]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 4]
mov dword [0x43d418], eax
push ecx
push 0x40
push dword [0x440f4c]
push dword [0x43d424]
call eax
mov esp, ebp
pop ebp
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x401443
pop dword [ebp - 0x38]
mov eax, 0x556a8994
add eax, 0xaad58aaf
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x2718d209
sub dword [ebp - 0x48], 0xd8c68cbe
mov dword [ebp - 0x44], 0xf755923e
sub dword [ebp - 0x44], 0xc52245f9
mov dword [ebp - 0x40], 0xc34de136
add dword [ebp - 0x40], 0x88fe62f8
mov dword [ebp - 0x3c], 0x6818d833
add dword [ebp - 0x3c], 0x97e727cd
lea eax, [ebp - 0x48]
push eax
mov eax, 0x726f0fdc
add eax, 0x8dd1709c
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x66f46331
sub dword [ebp - 0x48], 0xf281f9db
mov dword [ebp - 0x44], 0xa9ff6038
add dword [ebp - 0x44], 0x976d013d
mov dword [ebp - 0x40], 0x13d5638d
sub dword [ebp - 0x40], 0xb065f721
mov dword [ebp - 0x3c], 0xb30de76
add dword [ebp - 0x3c], 0xf4cf218a
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xe31e5981
sub eax, 0xe2ddd905
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3c2ad
push 0
call eax
mov ecx, 0x572a
mov ebx, eax
mov edx, 0x451400
add edx, dword [ebp - 0x38]
mov edi, 0x9c1248b0
sub dword [ebp - 0x14], ecx
mov esi, dword [edx]
add dword [ebp - 0x10], 0x785e7f0
xor esi, edi
xor dword [ebp - 0x2c], 0x3d103afb
mov dword [ebx], esi
mov dword [ebp - 0x14], 0x45d80298
add ebx, 0xaad1d005
sub ebx, 0xaad1d001
add edx, 0x8692e4f6
add edx, 0x796d1b0e
loop 0x401553
add eax, 0x14f7b
xor ebx, ebx
add ebx, eax
add eax, 0xdf86ee8
sub eax, 0xdf86ee3
mov ecx, 0xb907f460
add ecx, 0x47380ba0
add ecx, dword [ebp - 0x38]
call ebx
leave
ret