joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4217f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call sym.___pthread_self_lite
mov ebx, eax
mov dword [eax + 4], esi
mov eax, dword [eax + 0xb0]
test eax, eax
jne 0x42186b
test byte [ebx + 0x20], 0x30
je 0x421872
mov eax, dword [0x496e70]
test eax, eax
je 0x4218fb
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x421862
cmp dword [eax + 0x14], 0
je 0x421885
mov esi, dword [eax + 4]
mov dword [eax + 0x64], 1
mov eax, dword [eax + 0x18]
test eax, eax
je 0x421855
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
test byte [ebx + 0x24], 4
mov dword [ebx + 0x18], 0
jne 0x4218cf
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__endthreadex]
call sym.__pthread_cleanup_dest.part.3
jmp 0x42180d
add ebx, 0x6c
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym._longjmp
mov dword [eax], 0xdeadbeef
mov eax, dword [eax + 0x18]
test eax, eax
je 0x42189c
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x18], 0
mov esi, dword [ebx + 4]
je 0x4218f2
mov eax, dword [0x496e70]
test eax, eax
je 0x421921
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push edx
push edx
jmp 0x421862
mov eax, dword [ebx + 0x14]
mov dword [ebx], 0xdeadbeef
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
cmp dword [ebx + 0xac], 0
mov dword [ebx + 0x14], 0
jne 0x4218af
mov eax, ebx
call sym._push_pthread_mem.part.0
jmp 0x4218af
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x496e70], eax
jmp 0x421820
mov dword [esp + 8], sym.___shmem_winpthreads_init__pthread_tls_shmem
mov dword [esp + 4], 4
mov dword [esp], str._pthread_tls_shmem
call sym.___shmem_winpthreads_grab
mov dword [0x496e70], eax
jmp 0x4218b8
Function at 0x4241a0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [ebp + 8]
mov dword [esp], edi
call sym._strlen
mov ebx, eax
lea eax, [eax + 0x40]
and eax, 0xfffffff0
call fcn.0040dce0
mov edx, 0x326d
sub esp, eax
lea eax, [esp + 0x1b]
mov dword [esp + 4], edi
mov dword [esp + 8], ebx
lea esi, [esp + 0xc]
mov word [esp + 0x18], dx
mov dword [esp + 0xc], 0x2d636367
mov dword [esp], eax
mov dword [esp + 0x10], 0x656d6873
mov dword [esp + 0x14], 0x64742d6d
mov byte [esp + 0x1a], 0x2d
call sym._memcpy
lea eax, [ebx + 0x10]
lea edi, [esi + eax]
mov dword [ebp - 0x24], eax
lea eax, [ebx + 0x30]
mov dword [edi], 0x61616161
mov dword [edi + 4], 0x61616161
mov dword [edi + 8], 0x61616161
mov dword [edi + 0xc], 0x61616161
mov dword [edi + 0x10], 0x61616161
mov dword [edi + 0x14], 0x61616161
mov dword [edi + 0x18], 0x61616161
mov dword [edi + 0x1c], 0x61616161
mov dword [ebp - 0x1c], eax
mov byte [esp + ebx + 0x3c], 0
mov byte [esp + ebx + 0x1b], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
sub esp, 0xc
mov byte [esi + ebx + 0xf], 0x2d
mov dword [ebp - 0x20], eax
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
je 0x42428f
int3
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FindAtomA]
sub esp, 4
test ax, ax
jne 0x424333
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._malloc
mov edx, edi
mov ebx, eax
mov eax, 0x20
nop
lea esi, [esi]
bt ebx, eax
jae 0x4242c8
mov byte [edx], 0x41
add edx, 1
sub eax, 1
jne 0x4242c0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_AddAtomA]
sub esp, 4
test ax, ax
je 0x424330
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
cmp eax, ebx
mov esi, eax
je 0x42434a
mov dword [esp], ebx
call sym._free
mov edi, dword [ebp - 0x20]
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
int3
mov ecx, dword [ebp - 0x24]
mov edx, esi
movzx eax, ax
mov dword [esp], ecx
mov ecx, dword [ebp - 0x1c]
call sym._get_ptr_from_atom_1
mov esi, eax
jmp 0x424302
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 8], eax
call sym._memset
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x424302
mov dword [esp], ebx
call dword [ebp + 0x10]
jmp 0x424302
Function at 0x402442
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x402451
pop dword [ebp - 0xc]
mov eax, 0xd582ff3a
sub eax, 0xd542dae9
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xc5b28428
add dword [ebp - 0x1c], 0x889fc123
mov dword [ebp - 0x18], 0xb0b81b5
add dword [ebp - 0x18], 0x2727ca90
mov dword [ebp - 0x14], 0x64f8ae98
add dword [ebp - 0x14], 0xe7539596
mov dword [ebp - 0x10], 0xb8677a22
add dword [ebp - 0x10], 0x479885de
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x9a9eae50
sub eax, 0x9a5e9d80
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xc5a6723c
sub dword [ebp - 0x1c], 0x513408e6
mov dword [ebp - 0x18], 0x9c7eeb1
add dword [ebp - 0x18], 0x37a472c4
mov dword [ebp - 0x14], 0x700d9156
sub dword [ebp - 0x14], 0xc9e24ea
mov dword [ebp - 0x10], 0x7c2e0d5b
add dword [ebp - 0x10], 0x83d1f2a5
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x37ab1
push 0
call eax
mov ecx, 0xf27253ac
add ecx, 0xd8df72f
mov edi, eax
mov edx, 0x42f600
add edx, dword [ebp - 0xc]
mov esi, 0xe148157
add esi, 0xb6de0f8
sub dword [ebp - 8], 0xbec6a9
mov ebx, dword [edx]
xor dword [ebp - 4], 0x44a01e63
xor ebx, esi
sub dword [ebp - 8], edi
mov dword [edi], ebx
add dword [ebp - 4], edi
add edi, 0x9f22a5be
sub edi, 0x9f22a5ba
add edx, 0x36c081f8
sub edx, 0x36c081f4
loop 0x402568
add eax, 0x586a757d
add eax, 0xa796a8c2
mov ebx, eax
add eax, 5
mov ecx, 0x9fa87e66
sub ecx, 0x9f687e66
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x403547
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4014ac]
jne 0x4039b6
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x4073f8], eax
mov dword [0x4073f4], ecx
mov dword [0x4073f0], edx
mov dword [0x4073ec], ebx
mov dword [0x4073e8], esi
mov dword [0x4073e4], edi
mov word [0x407410], ss
mov word [0x407404], cs
mov word [0x4073e0], ds
mov word [0x4073dc], es
mov word [0x4073d8], fs
mov word [0x4073d4], gs
pushfd
pop dword [0x407408]
mov eax, dword [ebp]
mov dword [0x4073fc], eax
mov eax, dword [ebp + 4]
mov dword [0x407400], eax
lea eax, [ebp + 8]
mov dword [0x40740c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x407348], 0x10001
mov eax, dword [0x407400]
mov dword [0x4072fc], eax
mov dword [0x4072f0], 0xc0000409
mov dword [0x4072f4], 1
mov eax, dword [0x4014ac]
mov dword [ebp - 0x328], eax
mov eax, dword [0x407248]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x407340], eax
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x4014b8
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x407340], 0
jne 0x403aa2
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x403832
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x405338
call fcn.00403d57
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
cmp dword [0x407680], ebx
jne 0x4035cd
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], ebx
mov edi, 0x407674
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x403607
cmp eax, esi
jne 0x4035fa
xor esi, esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x40360a
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x4035e1
xor esi, esi
inc esi
mov eax, dword [0x407670]
cmp eax, esi
jne 0x40361d
push 0x1f
call sub.msvcr100.dll__amsg_exit
pop ecx
jmp 0x403658
mov eax, dword [0x407670]
test eax, eax
jne 0x403652
mov dword [0x407670], esi
push 0x40118c
push 0x40117c
call sub.msvcr100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x403658
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x403772
mov dword [0x4072e8], esi
mov eax, dword [0x407670]
cmp eax, esi
jne 0x40367c
push 0x401178
push 0x40116c
call sub.msvcr100.dll__initterm
pop ecx
pop ecx
mov dword [0x407670], 2
cmp dword [ebp - 0x24], ebx
jne 0x403689
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x407684], ebx
je 0x4036aa
push 0x407684
call fcn.00402442
pop ecx
test eax, eax
je 0x4036aa
push ebx
push 2
push ebx
call dword [0x407684]
mov eax, dword [sym.imp.msvcr100.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x403703
cmp al, bl
je 0x4036c3
cmp dword [ebp - 0x1c], ebx
jne 0x403703
mov al, byte [esi]
cmp al, bl
je 0x4036d3
cmp al, 0x20
ja 0x4036d3
inc esi
mov dword [ebp - 0x20], esi
jmp 0x4036c3
test byte [ebp - 0x40], 1
je 0x4036df
movzx eax, word [ebp - 0x3c]
jmp 0x4036e2
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x4072e4], eax
cmp dword [0x4072d8], ebx
jne 0x403758
push eax
call dword [sym.imp.msvcr100.dll_exit]
cmp al, 0x22
jne 0x403712
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcr100.dll__ismbblead]
pop ecx
test eax, eax
je 0x403725
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x4036b1
cmp dword [0x4072e8], ebx
jne 0x403766
call dword [sym.imp.msvcr100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x4072e4]
call fcn.00403d9c
ret
call fcn.00402442
jmp 0x40359f
Function at 0x401774
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x401783
pop dword [ebp - 0x44]
mov eax, 0x4c15883e
add eax, 0xb42a8f45
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xd4ed8806
add dword [ebp - 0x54], 0x7964bd45
mov dword [ebp - 0x50], 0xc1ce4be0
sub dword [ebp - 0x50], 0x8f9aff9b
mov dword [ebp - 0x4c], 0x91e98f1d
add dword [ebp - 0x4c], 0xba62b511
mov dword [ebp - 0x48], 0x31875e70
add dword [ebp - 0x48], 0xce78a190
lea eax, [ebp - 0x54]
push eax
mov eax, 0x47937c1b
add eax, 0xb8acf401
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x5ea3f1b
add dword [ebp - 0x54], 0x6e882a3b
mov dword [ebp - 0x50], 0x2d2cff7c
sub dword [ebp - 0x50], 0xebc09e07
mov dword [ebp - 0x4c], 0x714fe504
sub dword [ebp - 0x4c], 0xde07898
mov dword [ebp - 0x48], 0x905a2a4
sub dword [ebp - 0x48], 0x905a2a4
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x6412b3fc
sub eax, 0x63d243dc
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x388ad
push 0
call eax
mov ecx, 0x4b2a
xor edi, edi
add edi, eax
mov ebx, 0x40c800
add ebx, dword [ebp - 0x44]
mov esi, 0x66d5e2e5
sub esi, 0xac1ac647
mov edx, dword [ebx]
sub dword [ebp - 0x14], 0xfe99876e
add edx, esi
xor dword [ebp - 0x3c], ecx
mov dword [edi], edx
add dword [ebp - 0xc], edx
add edi, 0x598f357e
sub edi, 0x598f357a
add ebx, 0x97c0b2e8
add ebx, 0x683f4d1c
loop 0x40189b
add eax, 0x11f7b
mov ebx, eax
add eax, 5
mov ecx, 0x5d01b16f
add ecx, 0xa33e4e91
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x4045f7
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x406af3
call fcn.004054fb
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x404616
mov al, 1
jmp 0x4046e2
test esi, esi
je 0x4046e0
xor ebx, ebx
cmp word [esi], bx
je 0x4046e0
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4046e0
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x4046e0
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.00401774
pop ecx
pop ecx
mov esi, dword [0x40a010]
xor edi, edi
inc edi
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4046d1
lea eax, [ebp - 0x28]
push eax
call fcn.00401774
pop ecx
test al, al
jne 0x4046d1
cmp dword [ebp - 0x18], esi
jbe 0x4046d1
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x4046d1
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x4046d1
push 0x4075c8
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
movzx ebx, bl
pop ecx
pop ecx
cmovne ebx, edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], edi
call fcn.00401774
mov al, bl
jmp 0x4046e2
xor al, al
call fcn.004054b6
ret
Function at 0x4132f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41331d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41331d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1001861e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1001862d
pop dword [ebp - 0xc]
mov eax, 0x9a369318
add eax, 0x75caf315
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x4138d
push 0
mov eax, 0xffc8b5fe
add eax, 0x103aaade
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x7961886e
sub ecx, 0x79613da7
xor esi, esi
add esi, eax
mov edi, 0xebc31835
sub edi, 0xdbbf5a35
add edi, dword [ebp - 0xc]
mov ebx, 0xea384ac7
sub dword [ebp - 4], eax
mov edx, dword [edi]
add dword [ebp - 4], 0x1dd928ab
xor edx, ebx
xor dword [ebp - 8], 0xe9064ee8
mov dword [esi], edx
xor dword [ebp - 8], 0x93806abd
add esi, 0xfc7acfc0
add esi, 0x3853044
add edi, 0x5f85e3f
add edi, 0xfa07a1c5
loop 0x10018688
add eax, 0x11def
mov ebx, eax
add eax, 5
mov ecx, 0xf2b73a43
add ecx, 0x1d48c5bd
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001861e
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001861e
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40673a
pop dword [ebp - 0x34]
mov eax, 0x74490a2c
add eax, 0x8bf75d0e
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xaba6fa24
sub dword [ebp - 0x44], 0x5d54b4d9
mov dword [ebp - 0x40], 0x38695d5c
add dword [ebp - 0x40], 0xf9c9eee9
mov dword [ebp - 0x3c], 0x50d164
sub dword [ebp - 0x3c], 0xb4048d36
mov dword [ebp - 0x38], 0x386031de
add dword [ebp - 0x38], 0xc79fce22
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xf79f678e
sub dword [ebp - 0x44], 0x832cfe38
mov dword [ebp - 0x40], 0x49c70fbf
sub dword [ebp - 0x40], 0x85aae4a
mov dword [ebp - 0x3c], 0xa8ebe982
add dword [ebp - 0x3c], 0xba8382ea
mov dword [ebp - 0x38], 0x4270e918
sub dword [ebp - 0x38], 0x4270e918
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x18ed7961
sub eax, 0x18acf861
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x39071
push 0
call eax
mov ecx, 0xc01b78d1
sub ecx, 0xc01b2ac5
xor edx, edx
add edx, eax
mov edi, 0x46e400
add edi, dword [ebp - 0x34]
mov esi, 0xf7a3dbc1
sub esi, 0xd99dfabd
add dword [ebp - 8], 0xe07a70e4
mov ebx, dword [edi]
add dword [ebp - 0x20], 0x9366f0f3
add ebx, esi
xor dword [ebp - 0x1c], 0xe16957cf
mov dword [edx], ebx
xor dword [ebp - 0x28], edi
add edx, 0xb1bc098
sub edx, 0xb1bc094
add edi, 4
loop 0x406853
add eax, 0x12b03
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10009830
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10009830
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10009830
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10009830
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10009830
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10009830
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10009830
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10009830
push 0xd008
push edi
call fcn.10009830
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10009830
int3

Function at 0x10009830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1000983f
pop dword [ebp - 0x50]
mov eax, 0x1000983f
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x3b47f
push 0
mov eax, 0x9c4e6b9c
add eax, 0x73b2d4c8
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x6269de77
sub ecx, 0x62698d59
mov esi, eax
mov edi, 0x10018600
add edi, dword [ebp - 0x50]
mov edx, 0x1befd336
xor dword [ebp - 0x34], 0xea24c405
mov ebx, dword [edi]
mov dword [ebp - 4], 0x5fd4107c
sub ebx, edx
add dword [ebp - 0x4c], eax
mov dword [esi], ebx
add dword [ebp - 0x4c], ecx
add esi, 0x21c6218e
add esi, 0xde39de76
add edi, 0x822201cf
sub edi, 0x822201cb
loop 0x1000988d
add eax, 0x1374b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x4254f5d
add ecx, 0xbdab0a3
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x40110c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80e030]
jne 0x401116
repz ret
jmp fcn.00401b11

Function at 0x408edc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004047d5
and dword [ebp - 4], 0
cmp dword [0x81078c], 0
mov ebx, eax
jne 0x408f8d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40903e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40903e
push eax
call fcn.00404763
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x81078c], eax
call esi
push eax
call fcn.00404763
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x810790], eax
call esi
push eax
call fcn.00404763
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x810794], eax
call esi
push eax
call fcn.00404763
pop ecx
mov dword [0x81079c], eax
test eax, eax
je 0x408f8d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404763
pop ecx
mov dword [0x810798], eax
mov eax, dword [0x810798]
cmp eax, ebx
je 0x408fe5
cmp dword [0x81079c], ebx
je 0x408fe5
push eax
call fcn.004047de
push dword [0x81079c]
mov esi, eax
call fcn.004047de
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408fe5
test edi, edi
je 0x408fe5
call esi
test eax, eax
je 0x408fdc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408fdc
test byte [ebp - 0xc], 1
jne 0x408fe5
or dword [ebp + 0x10], 0x200000
jmp 0x40901e
mov eax, dword [0x810790]
cmp eax, ebx
je 0x40901e
push eax
call fcn.004047de
pop ecx
test eax, eax
je 0x40901e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40901e
mov eax, dword [0x810794]
cmp eax, ebx
je 0x40901e
push eax
call fcn.004047de
pop ecx
test eax, eax
je 0x40901e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x81078c]
call fcn.004047de
pop ecx
test eax, eax
je 0x40903e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409040
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b0e0
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x80e030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2ec91cc]
push ebx
mov ebx, dword [0x2ec8eec]
push esi
mov esi, dword [0x80ef60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40b121
push str.lefovuweceh
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x2ec91cc]
mov dword [0x2ec8ee8], esi
cmp eax, 0x114e
jne 0x40b14b
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [esp + 0x14]
push eax
push str.durinarusunavabaxomoyowev
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x2ec91cc]
cmp eax, 0x2f
jne 0x40b16d
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
call fcn.0040b050
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040110c
add esp, 0x428
ret