joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403161
Capabilities:
Accept command line arguments

Disassembly:
push 0x74
mov eax, 0x4243b1
call fcn.0042192d
mov bl, cl
lea ecx, [ebp - 0x74]
call fcn.004017cb
xor edi, edi
mov edx, str.downloader.
test bl, bl
mov dword [ebp - 4], edi
mov ecx, str._stat.
cmove ecx, edx
mov edx, eax
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00405468
pop ecx
push edi
push 1
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 2
call fcn.004040bc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea ecx, [ebp - 0x5c]
call fcn.00406d96
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.00404e37
push edi
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
call fcn.004040bc
mov esi, str..log
mov ecx, esi
call fcn.004010d7
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.00404d97
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push 0x42b838
cmovae eax, dword [ebp - 0x2c]
push eax
call fcn.0040f815
push str._n
push eax
mov dword [0x4305a8], eax
call fcn.0040103c
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
add esp, 0x10
call esi
test eax, eax
je 0x403224
call esi
jmp 0x403229
mov eax, 0x42ac44
push eax
push str.cmd:__s_n
push dword [0x4305a8]
call fcn.0040103c
sub esp, 0xc
mov ecx, esp
call fcn.00406a04
lea ecx, [ebp - 0x44]
call fcn.00406a65
push 4
pop ebx
mov byte [ebp - 4], bl
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 8
cmovae eax, dword [ebp - 0x44]
push eax
push str.ver:__s_n
push dword [0x4305a8]
call fcn.0040103c
add esp, 0x24
lea ecx, [ebp - 0x5c]
call fcn.00402302
cmp dword [eax + 0x14], 8
jb 0x403281
mov eax, dword [eax]
push eax
push str.os:__s_n
push dword [0x4305a8]
call fcn.0040103c
add esp, 0xc
lea ecx, [ebp - 0x5c]
push edi
push 1
call fcn.004040bc
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], edi
push eax
push 8
mov esi, edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4032d9
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], ebx
push eax
push ebx
lea eax, [ebp - 0x7c]
push eax
push 0x14
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne esi, dword [ebp - 0x7c]
cmp dword [ebp - 0x78], 0
je 0x4032e8
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x42b91c
test esi, esi
mov eax, 0x42b914
cmove eax, ecx
push eax
push str.elevated:__s_n
push dword [0x4305a8]
call fcn.0040103c
add esp, 0xc
lea ecx, [ebp - 0x44]
push edi
push 1
call fcn.004040bc
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.004040bc
call fcn.004218d7
ret
Function at 0x40634d
Capabilities:
Accept command line arguments

Disassembly:
push 0x88
mov eax, 0x42473d
call fcn.0042192d
mov eax, dword [ebp + 0x10]
xor ebx, ebx
test eax, eax
je 0x406378
push str.__stat
push eax
call fcn.00408bc4
pop ecx
pop ecx
mov cl, 1
test eax, eax
jne 0x40637a
mov cl, bl
call fcn.00403161
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
call fcn.0040674d
mov dword [ebp - 0x90], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x58]
call fcn.00403ec6
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x58]
call fcn.0040249b
xor eax, eax
mov dword [ebp - 0x2c], 0xf
push str.noaction
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x30], ebx
mov edi, ebx
mov byte [ebp - 0x40], bl
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
call fcn.0040430d
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x90]
call fcn.00405982
mov ebx, dword [ebp - 0x90]
mov esi, eax
cmp esi, ebx
je 0x40640b
lea eax, [esi + 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00405937
test al, al
je 0x40640d
mov esi, ebx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004040bc
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
cmp esi, ebx
je 0x40649c
xor ebx, ebx
push str.partner
mov dword [ebp - 0x18], ebx
call fcn.0040430d
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x90]
call fcn.00403d48
push ebx
push 1
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.004040bc
cmp dword [esi + 0x10], ebx
je 0x406494
push str.noaction_p
lea ecx, [ebp - 0x40]
call fcn.004044d3
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00403eeb
lea ecx, [ebp - 0x70]
call fcn.00406c6b
add esp, 0x18
lea ecx, [ebp - 0x40]
push 0xffffffffffffffff
push ebx
push eax
call fcn.004046a3
lea ecx, [ebp - 0x70]
jmp 0x406520
xor edi, edi
inc edi
jmp 0x406539
and dword [ebp - 0x18], edi
push str.stat
call fcn.0040430d
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x90]
call fcn.00405982
mov ebx, dword [ebp - 0x90]
mov esi, eax
cmp esi, ebx
je 0x4064d5
lea eax, [esi + 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00405937
test al, al
je 0x4064d7
mov esi, ebx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.004040bc
cmp esi, ebx
je 0x40652a
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x88]
call fcn.004060da
mov esi, eax
lea eax, [ebp - 0x40]
xor ebx, ebx
cmp eax, esi
je 0x406516
push ebx
push 1
mov ecx, eax
call fcn.00404480
push esi
lea ecx, [ebp - 0x40]
call fcn.00404741
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
push ebx
push 1
call fcn.00404480
jmp 0x406539
lea ecx, [ebp - 0x90]
call fcn.00403434
mov edi, eax
xor ebx, ebx
cmp dword [ebp - 0x30], 0
je 0x406551
cmp dword [ebp - 0x2c], 0x10
lea ecx, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x40]
call fcn.00406894
mov edi, eax
push edi
push str.stat_res:__d_n
push dword [0x4305a8]
call fcn.0040103c
add esp, 0xc
push dword [0x4305a8]
call fcn.0040aee7
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.00404480
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.004040bc
lea ecx, [ebp - 0x90]
call fcn.004065ce
mov eax, edi
call fcn.004218d7
ret 0x10
Function at 0x406807
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
and dword [ebp - 0x24], 0
xor eax, eax
and dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0x10
push esi
push edi
push 7
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 4]
mov dword [ebp - 0x20], 2
push ecx
lea ecx, [ebp - 0x24]
push ecx
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push 0x42bda4
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x406854
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor esi, esi
jmp 0x406880
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [edx + 0x18]
movzx esi, byte [ecx + 4]
movzx eax, byte [ecx + 5]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 6]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 7]
shl esi, 8
or esi, eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
push 0
push 1
lea ecx, [ebp + 8]
call fcn.00404480
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x406894
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9ac
mov eax, dword [0x42f024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
jne 0x4068b8
xor eax, eax
inc eax
jmp 0x4069bf
lea eax, [ebp - 0x9a8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4068b0
sub esp, 0x18
mov ecx, esp
push str.clck.yandex.ru
and dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
mov byte [ecx], al
call fcn.004044d3
call fcn.00406807
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x4068b0
push 0
push 1
push 2
pop eax
push eax
call dword [sym.imp.WS2_32.dll_socket]
push 2
mov esi, eax
pop eax
push 0x50
mov word [ebp - 0x818], ax
call dword [sym.imp.WS2_32.dll_htons]
push ebx
mov word [ebp - 0x816], ax
call dword [sym.imp.WS2_32.dll_htonl]
push 0x10
lea ecx, [ebp - 0x818]
mov dword [ebp - 0x814], eax
push ecx
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x406946
push 2
pop eax
jmp 0x4069bf
push edi
push str.GET__click_dtypestred_pid12_cid72435_path_s__HTTP_1.1_r_nUser_Agent:_curl_1.1_r_nHost:_clck.yandex.ru_r_nAccept:_._r_n_r_n
lea eax, [ebp - 0x808]
push 0x800
push eax
call fcn.004067eb
lea ecx, [ebp - 0x808]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406969
xor ebx, ebx
lea eax, [ebp - 0x808]
push ebx
sub ecx, edx
push ecx
push eax
push esi
call dword [sym.imp.WS2_32.dll_send]
push 1
push esi
call dword [sym.imp.WS2_32.dll_shutdown]
push ebx
push 0x2000
push 0x4305b0
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x4069b0
cmp eax, 0x2001
jae 0x4069d0
mov byte [eax + 0x4305b0], bl
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004078e5
mov esp, ebp
pop ebp
ret
call fcn.00407d15
int3
Function at 0x406a65
Capabilities:
Get file version info

Disassembly:
push 0xf4
mov eax, 0x424799
call fcn.0042192d
mov esi, ecx
mov dword [ebp - 0xf4], esi
xor edi, edi
mov dword [ebp - 0xf8], edi
mov dword [ebp - 4], edi
lea ecx, [ebp - 0xfc]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push ecx
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
jne 0x406abe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x42ac44
mov ecx, esi
call fcn.00403ec6
push edi
jmp 0x406b9f
push ebx
call fcn.00407bc6
mov edi, eax
pop ecx
test edi, edi
jne 0x406adc
push 0x42ac44
mov ecx, esi
call fcn.00403ec6
jmp 0x406b9d
xor ecx, ecx
mov dword [ebp - 0xdc], 7
xor eax, eax
mov dword [ebp - 0xe0], ecx
mov word [ebp - 0xf0], ax
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
push edi
cmovae eax, dword [ebp + 8]
push ebx
push ecx
push eax
mov dword [ebp - 0xf4], ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x406b79
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0xf4]
push eax
push 0x42bdb8
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
mov ecx, dword [ebp - 0xf4]
test ecx, ecx
je 0x406b79
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
lea eax, [ebp - 0xd8]
push 0x42bdbc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea eax, [ebp - 0xd8]
lea ecx, [ebp - 0xf0]
push eax
call fcn.0040430d
push edi
call fcn.004078f6
pop ecx
lea eax, [ebp - 0xf0]
mov ecx, esi
push eax
call fcn.00403ea1
push 0
push 1
lea ecx, [ebp - 0xf0]
call fcn.004040bc
push 0
push 1
lea ecx, [ebp + 8]
call fcn.004040bc
mov eax, esi
call fcn.004218d7
ret
Function at 0x41aa41
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041a6ef

Function at 0x41e65c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041e4db
Function at 0x402170
Capabilities:
Execute command

Disassembly:
call fcn.004017e0
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
xor eax, eax
ret

Function at 0x402bd4
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402c13
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402c13
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402c13
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402c13
cmp dword [ecx + 0x74], 0xe
jbe 0x402c13
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x4209ab
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4209ea
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4209ea
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4209ea
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4209ea
cmp dword [ecx + 0x74], 0xe
jbe 0x4209ea
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433160
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43318d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43318d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x51f55c87
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..text_1
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x2ffa2c5d
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x7e1927cf
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, str.X_m
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x5b1824dd
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x41ec8c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00415f87
and dword [ebp - 0x14], 0
cmp dword [0x461790], 0
mov dword [ebp - 0x18], eax
jne 0x41ed3f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41ede7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41ede7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x461790], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x461794], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x461798], eax
call edi
push eax
call esi
mov dword [0x4617a0], eax
test eax, eax
je 0x41ed3f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46179c], eax
mov eax, dword [0x46179c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41ed98
cmp dword [0x4617a0], ecx
je 0x41ed98
push eax
call esi
push dword [0x4617a0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41ed98
test ebx, ebx
je 0x41ed98
call edi
test eax, eax
je 0x41ed8f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41ed8f
test byte [ebp - 8], 1
jne 0x41ed98
or dword [ebp + 0x10], 0x200000
jmp 0x41edcb
mov eax, dword [0x461794]
cmp eax, dword [ebp - 0x18]
je 0x41edcb
push eax
call esi
test eax, eax
je 0x41edcb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41edcb
mov eax, dword [0x461798]
cmp eax, dword [ebp - 0x18]
je 0x41edcb
push eax
call esi
test eax, eax
je 0x41edcb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x461790]
call esi
test eax, eax
je 0x41ede7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41ede9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004106c7
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401b20
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407048
call sym._EnterCriticalSection_4
mov ebx, dword [0x407040]
sub esp, 4
test ebx, ebx
je 0x401b6b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401b64
test esi, esi
je 0x401b64
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401b40
mov dword [esp], 0x407048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401d50
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401da0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401e78
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401dde
cmp eax, 4
jne 0x401e00
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401dee
cmp edx, 4
je 0x401dee
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401d50
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x20160e0a
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..tls
nop
nop
nop
cmp eax, 0
je 0x4320d2
nop
nop
nop
nop
nop
mov ebx, 0x42f314
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x228c5999
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40ce09
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422234]
jne 0x40ce13
repz ret
jmp fcn.00413639

Function at 0x413b7e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004104e0
and dword [ebp - 4], 0
cmp dword [0x423e1c], 0
mov ebx, eax
jne 0x413c2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413ce0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413ce0
push eax
call fcn.0041046e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423e1c], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423e20], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x423e24], eax
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e2c], eax
test eax, eax
je 0x413c2f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e28], eax
mov eax, dword [0x423e28]
cmp eax, ebx
je 0x413c87
cmp dword [0x423e2c], ebx
je 0x413c87
push eax
call fcn.004104e9
push dword [0x423e2c]
mov esi, eax
call fcn.004104e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413c87
test edi, edi
je 0x413c87
call esi
test eax, eax
je 0x413c7e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413c7e
test byte [ebp - 0xc], 1
jne 0x413c87
or dword [ebp + 0x10], 0x200000
jmp 0x413cc0
mov eax, dword [0x423e20]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413cc0
mov eax, dword [0x423e24]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423e1c]
call fcn.004104e9
pop ecx
test eax, eax
je 0x413ce0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413ce2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x46897a3d
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x611f455f
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219