joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4566f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xf8
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x456764
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x18]
jae 0x4567ad
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.0046f8b0
add esp, 8
test eax, eax
jne 0x4567ab
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dx, word [ecx + eax*2]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x4567af
jmp 0x45675b
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x45f274
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.00458d73
add esp, 4
and eax, 0xff
test eax, eax
je 0x45f2fd
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea eax, [ebp - 0x2cc]
push eax
call fcn.0046a050
add esp, 0xc
mov dword [ebp - 0x2cc], 0x10001
lea ecx, [ebp - 0x2cc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x45f2fb
mov ecx, dword [ebp - 0x214]
cmp ecx, dword [ebp + 0xc]
jne 0x45f2fb
jmp 0x45f2fd
jmp 0x45f27d
mov esp, ebp
pop ebp
ret

Function at 0x45f75c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
movsx eax, byte [0x487814]
test eax, eax
jne 0x45f770
call fcn.0045f6a4
xor ecx, ecx
mov cl, byte [0x487811]
test ecx, ecx
jne 0x45f7f7
xor edx, edx
mov dl, byte [0x487810]
test edx, edx
jne 0x45f7f7
cmp dword [0x487918], 0
je 0x45f7d2
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x180
mov ecx, dword [0x487918]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 4], eax
push 0
mov edx, dword [ebp - 4]
push edx
push 0x186
mov eax, dword [0x487918]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x487918]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x45f7f7
push 0x10001
push 0x487814
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x45f7f7
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x4627da
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x4627ea
xor eax, eax
jmp 0x4629b3
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x46296b
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x48599c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x48599c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x48599c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x48599c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x48599c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x48599c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x48599c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x48599c]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 8
mov dword [ebp + 0x10], ecx
jmp 0x4627f3
cmp dword [ebp + 0x10], 0
je 0x4629ad
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
mov eax, dword [ecx*4 + 0x48599c]
xor eax, edx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0x462971
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x46c160
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x482fb8
cmp edx, dword [eax]
je 0x46c182
add eax, 8
inc ecx
cmp eax, 0x483048
jl 0x46c173
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x482fb8]
jne 0x46c2b0
mov eax, dword [0x487998]
cmp eax, 1
je 0x46c28a
test eax, eax
jne 0x46c1b3
cmp dword [0x482cf4], 1
je 0x46c28a
cmp edx, 0xfc
je 0x46c2b0
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x46c1ea
lea eax, [ebp - 0x1a4]
push 0x486db8
push eax
call fcn.0046a4c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0046a240
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x46c22d
lea eax, [ebp - 0x1a4]
push eax
call fcn.0046a240
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x486db4
push edi
call fcn.0046a670
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x486d98
push eax
call fcn.0046a4c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0046a4d0
lea eax, [ebp - 0xa0]
push 0x486d94
push eax
call fcn.0046a4d0
push dword [esi + 0x482fbc]
lea eax, [ebp - 0xa0]
push eax
call fcn.0046a4d0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x486d6c
push eax
call fcn.0046e728
add esp, 0x2c
pop edi
jmp 0x46c2b0
lea eax, [ebp + 8]
lea esi, [esi + 0x482fbc]
push 0
push eax
push dword [esi]
call fcn.0046a240
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x8a59f3
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xf42b72
cpuid
jmp 0xf37302
jmp 0xf4aead
jmp 0xf3775b
rdtsc
jmp 0xf3780f
jmp 0xf64b59
sub esp, 4
mov dword [esp], esi
push esi
push 0x42f13015
pop esi
mov dword [esp + 4], esi
pop esi
mov dword [esp], ebx
jmp 0xf38f6f
jmp 0xf3a06d
jmp 0xf3a0c1
push edi
mov dword [esp], eax
mov dword [esp], esi
mov dword [esp], ecx
jmp 0xf3a185
jmp 0xf55579
jmp 0xf3baa1
cpuid
jmp 0xf3bb03
jmp 0xf40ab7
push ebp
push eax
mov eax, 0
mov dword [esp + 4], eax
mov eax, dword [esp]
add esp, 4
mov eax, dword [esp]
add esp, 4
jmp 0xf40bd2
jmp 0xf371f9
push edx
mov edx, esp
add edx, 4
push ecx
push 0x14
pop ecx
sub edx, ecx
push dword [esp]
pop ecx
add esp, 4
xchg dword [esp], edx
pop esp
jmp 0xf41b4d
jmp 0xf38e41
jmp 0xf42c20
push ecx
push edx
push 0x45654d5b
pop edx
mov dword [esp + 4], edx
mov edx, dword [esp]
add esp, 4
jmp 0xf42c85
mov dword [esp], ebp
jmp 0xf42c8d
jmp 0xf53421
jmp 0xf47e8c
shl ecx, 5
jp 0xf47e8c
jmp 0xf47eea
push ecx
push 0x77d7ed3c
push dword [esp]
pop ecx
push ecx
mov ecx, esp
jmp 0xf47ef8
sub ecx, 0x5025880
mov eax, ecx
pop ecx
jmp 0xf47fbe
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
not ecx
inc ecx
jg 0xf47eea
jmp 0xf47e7e
jmp 0xf3b9ed
jmp 0xf49f3a
push esi
mov esi, esp
push edi
mov edi, 4
add esi, edi
pop edi
sub esi, 4
xor esi, dword [esp]
xor dword [esp], esi
xor esi, dword [esp]
pop esp
mov dword [esp], edx
pop dword [ebp - 0x10]
jmp 0xf49ffc
jmp 0xf5e20b
jmp 0xf4af5e
push 0
push dword [esp]
mov eax, dword [esp]
add esp, 4
push edx
mov edx, esp
jmp fcn.00f4af77
jmp 0xf53497
add dword [esp + 4], ecx
pop ecx
push dword [esp]
pop ebp
add esp, 4
jmp 0xf5355d
push 0x4d327f8a
mov dword [esp], esp
push ecx
mov ecx, 4
jmp 0xf53483
jmp 0xf41a25
jmp 0xf55673
push ebx
mov dword [esp], 0x7e4a5041
mov dword [esp], ebx
push esi
mov esi, 0x765c59f5
mov dword [esp + 4], esi
pop esi
mov dword [esp], edx
jmp 0xf55691
jmp 0xf37703
jmp 0xf5665f
cpuid
jmp 0xf56666
jmp 0xf47e79
jmp 0xf5e29c
push ebx
mov dword [esp], eax
push edx
mov edx, 0
mov dword [esp + 4], edx
pop edx
mov eax, dword [esp]
add esp, 4
jmp 0xf5e30b
jmp 0xf56541
jmp 0xf64c4c
push edi
mov edi, esp
push ebx
mov ebx, 4
add edi, ebx
mov ebx, dword [esp]
add esp, 4
sub edi, 4
xchg dword [esp], edi
pop esp
mov dword [esp], eax
pop dword [ebp - 0x14]
jmp 0xf64c72
jmp 0xf49ed5
Function at 0x416e70
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0040b2a0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x416f3b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x416f3b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x416eee
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x416ef9
or bh, 8
and edi, 0x8000000
je 0x416f14
mov eax, dword [0x43591c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x416f3b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417310
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x41733b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x41735f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x41737a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x419a69
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x4237d8
call fcn.0040a3f0
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.00420410
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x419aa8
call fcn.00420410
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x419ab6
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x419ac4
or eax, 0xffffffff
jmp 0x419bac
mov ecx, esi
call fcn.004199df
mov dword [ebp - 0x14], eax
call fcn.0041a89e
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x419afb
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x419afb
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.0041a852
push dword [ebp - 0x14]
call fcn.0041a384
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.00419777
cmp eax, edi
je 0x419b6e
test byte [esi + 0x24], 0x10
je 0x419b3c
push 4
mov ecx, esi
pop ebx
call fcn.0041c96b
test ah, 1
je 0x419b34
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.0041c3a5
cmp dword [esi + 0x1c], edi
je 0x419b6e
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0041ca51
jmp 0x419b6e
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x419b82
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x419b9b
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x419b9b
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.00419a19
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x41c253
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41c295
call fcn.00420410
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x41c295
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x41c28c
xor eax, eax
jmp 0x41c29d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0041c2a3
pop edi
pop esi
pop ebx
ret 4
Function at 0x420c18
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x420c46
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x420c64
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00420b7e
jmp 0x420c64
mov eax, dword [esi + 0x14]
test eax, eax
je 0x420c64
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00420b7e
test edi, edi
mov eax, edi
jne 0x420c4e
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x444000
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x52fe27
nop
push 0x444024
pop edi
nop
nop
mov esi, 0x598
nop
push dword [esi + edi]
xor dword [esp], ecx
pop dword [esi + edi]
nop
sub esi, 2
sub esi, 2
nop
nop
jne 0x444014
iretd

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x5e26458f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..text_1
nop
mov ebx, 0x4304d8
mov ecx, 0x515c08fc
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40131a
Capabilities:
Create process on windows

Disassembly:
pushal
push 0x403120
call sub.kernel32.dll_GetStartupInfoA

Function at 0x401571
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, 0x403084
push 1
push 0
push 0
push dword [0x403054]
push edi
call sub.user32.dll_PeekMessageA
or eax, eax
je 0x4015c0
mov eax, 0x403011
cmp byte [eax], 0
je 0x4015a2
push edi
call sub.user32.dll_TranslateMessage
push edi
call sub.user32.dll_DispatchMessageA
push 0x14
call sub.user32.dll_GetKeyState
mov ecx, 0x403194
and byte [ecx], 0x7f
shl al, 7
or byte [ecx], al
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0xc]
mov edx, dword [edi + 4]
inc edi
ret

Function at 0x4015c1
Capabilities:
Create process on windows

Disassembly:
push eax
push edi
call sub.kernel32.dll_WinExec
ret

Function at 0x401668
Capabilities:
Accept command line arguments

Disassembly:
pop esi
mov edx, dword [section..data]
lea edi, [edx + 0xc3500]
mov ecx, edi
sub ecx, esi
lodsb al, byte [esi]
inc eax
stosb byte es:[edi], al
lodsd eax, dword [esi]
sub eax, ecx
stosd dword es:[edi], eax
lodsb al, byte [esi]
cmp al, 0xe8
je 0x40167a
push edi
push edx
call sub.kernel32.dll_GetCommandLineA
lea edi, [edx + 4]
push edi
xchg esi, eax
lodsb al, byte [esi]
cmp al, 0x22
je 0x401691
stosb byte es:[edi], al
cmp al, 0x20
ja 0x401691
mov byte [edi - 1], 0
pop edx
call fcn.004014d3
pop edx
add edx, 0x64
mov ecx, 0x1800
call fcn.00401527
xor ebp, ebp
pop edi
push edi
xchg ebx, eax
push 2
pop ecx
call fcn.00401527
je 0x4016e5
mov cx, word [edx]
jcxz 0x4016f3
xchg ebx, eax
call fcn.00401527
je 0x4016e5
mov esi, edx
lodsw ax, word [esi]
cmp byte [esi], 1
jne 0x4016e5
add ecx, esi
call fcn.0040136f
add edi, eax
inc ebp
jmp 0x4016b7
lea eax, [edx - 0x64]
mov dword [eax], 0x20646142
call fcn.004016f7
dec ebp
jl 0x4016e5
ret
Function at 0x40195f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x401971
xor eax, eax
jmp 0x401a32
push ebx
push edi
call fcn.00401a73
mov edx, dword [ebp + 0x10]
cmp edx, 8
mov edi, dword [ebp + 8]
not edi
mov ecx, 0xff
jb 0x401a16
mov ebx, edx
shr ebx, 3
mov dword [ebp + 0xc], ebx
xor ebx, ebx
mov bl, byte [esi]
sub edx, 8
xor ebx, edi
and ebx, ecx
shr edi, 8
xor edi, dword [eax + ebx*4]
xor ebx, ebx
inc esi
mov bl, byte [esi]
xor ebx, edi
and ebx, ecx
shr edi, 8
xor edi, dword [eax + ebx*4]
xor ebx, ebx
inc esi
mov bl, byte [esi]
xor ebx, edi
and ebx, ecx
shr edi, 8
xor edi, dword [eax + ebx*4]
xor ebx, ebx
inc esi
mov bl, byte [esi]
xor ebx, edi
and ebx, ecx
shr edi, 8
xor edi, dword [eax + ebx*4]
xor ebx, ebx
inc esi
mov bl, byte [esi]
xor ebx, edi
and ebx, ecx
shr edi, 8
xor edi, dword [eax + ebx*4]
xor ebx, ebx
inc esi
mov bl, byte [esi]
xor ebx, edi
and ebx, ecx
shr edi, 8
xor edi, dword [eax + ebx*4]
xor ebx, ebx
inc esi
mov bl, byte [esi]
xor ebx, edi
and ebx, ecx
shr edi, 8
xor edi, dword [eax + ebx*4]
xor ebx, ebx
inc esi
mov bl, byte [esi]
xor ebx, edi
and ebx, ecx
shr edi, 8
xor edi, dword [eax + ebx*4]
inc esi
dec dword [ebp + 0xc]
jne 0x401996
test edx, edx
je 0x401a2c
xor ebx, ebx
mov bl, byte [esi]
xor ebx, edi
and ebx, ecx
shr edi, 8
xor edi, dword [eax + ebx*4]
inc esi
dec edx
jne 0x401a1a
mov eax, edi
pop edi
not eax
pop ebx
pop esi
pop ebp
ret

Function at 0x40352c
Capabilities:
Terminate process

Disassembly:
push edi
xor edi, edi
cmp dword [0x426944], edi
jne 0x40354b
cmp dword [0x41a15c], edi
jg 0x403550
dec dword [0x41a15c]
mov dword [0x426890], edi
or eax, 0xffffffff
pop edi
ret
cmp dword [0x426890], edi
push esi
jg 0x4035c6
mov esi, 0x2000
push esi
push dword [0x426888]
push dword [0x4268ac]
call fcn.0041068d
add esp, 0xc
cmp eax, edi
mov dword [0x426890], eax
jne 0x403587
mov dword [0x426890], edi
or eax, 0xffffffff
jmp 0x4035dc
jge 0x4035b1
push 0x401
mov esi, str.error:__zipfile_read_error_n
push esi
call fcn.00409640
pop ecx
push eax
push esi
push 0x41a0c0
call dword [fcn.00426abc]
add esp, 0x10
push 3
call fcn.00409b4a
mov eax, dword [0x426888]
add dword [0x4268b4], esi
mov dword [0x42688c], eax
call fcn.00403431
mov eax, dword [0x42688c]
dec dword [0x426890]
mov al, byte [eax]
inc dword [0x42688c]
movzx eax, al
pop esi
pop edi
ret