joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5abdb0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + 0x7e64ef]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x7e647f]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x5abdc3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x5abe04
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x7e6527]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x5abe36
mov bl, byte [esp + ecx + 0x4c]
jmp 0x5abe3a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x5abe2b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x5abe58
mov bl, byte [esp + ecx + 0x4c]
jmp 0x5abe5c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x5abe4d
xor ecx, ecx
mov eax, 0x7e648f
xor ebx, ebx
mov bl, byte [ecx + 0x7e6537]
cmp byte [esp + ebx + 0x14], 0
je 0x5abe87
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x7e654f]
cmp byte [esp + ebx + 0x14], 0
je 0x5abe9e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, 0x7e64ef
jl 0x5abe6e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x5abdf7
lea edx, [esp + 0x84]
push edx
call fcn.005abee0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x5c9b00
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x80acfc]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x5c9b13
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x5c9b54
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x80ada4]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x5c9b86
mov bl, byte [esp + ecx + 0x4c]
jmp 0x5c9b8a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x5c9b7b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x5c9ba8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x5c9bac
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x5c9b9d
xor ecx, ecx
mov eax, 0x80ad0c
xor ebx, ebx
mov bl, byte [ecx + 0x80adb4]
cmp byte [esp + ebx + 0x14], 0
je 0x5c9bd7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x80adcc]
cmp byte [esp + ebx + 0x14], 0
je 0x5c9bee
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x5c9bbe
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x5c9b47
lea edx, [esp + 0x84]
push edx
call fcn.005c9c30
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x5cb7c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x5cb826
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep_1]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x5cb826
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x5cb807
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x5cbbb0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x5cbbe8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x5cc910
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x5cc959
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x5ccdd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60b0d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.005cc980
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.005cca00
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.005cca00
lea ecx, [esi + 0xc]
call fcn.005f9263
lea ecx, [esi + 0x10]
call fcn.005f9263
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.005cdf90
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.005cdf90
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.005cdf90
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.005f92d8
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.005f92d8
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x5d11a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x860034]
xor edx, edx
cmp eax, edx
jne 0x5d11c6
xor eax, eax
mov byte [eax + 0x85ff34], al
inc eax
cmp eax, 0x100
jl 0x5d11ae
mov dword [0x860034], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x85ff34
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x5d1257
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x5d122a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x5d11f8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x5d1260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x5d12b3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x5d129a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5d7c30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60b4ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.005d8550
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x7ad3bc
call fcn.005f9019
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x5d7cc3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.005f9019
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x5d7cbc
push 0
mov ecx, eax
call fcn.005cede0
mov dword [esi + 0xc], eax
jmp 0x5d7cc5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x5d7cc5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x5fb6e6
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5fb71e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005f9733
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA_1]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005f970b
jmp 0x5fb72a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5fcedd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5fcf1f
call fcn.006035a0
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5fcf1f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5fcf16
xor eax, eax
jmp 0x5fcf27
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005fcf2d
pop edi
pop esi
pop ebx
ret 4

Function at 0x603ad0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection_1]
cmp dword [esp + 0x10], 0
jne 0x603afe
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue_1]
test eax, eax
je 0x603b1c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00603a36
jmp 0x603b1c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x603b1c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00603a36
test edi, edi
mov eax, edi
jne 0x603b06
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection_1]
pop esi
pop ebx
ret 8
Function at 0x401520
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x24
push esi
push edi
push 0x1c
lea eax, [esp + 0x14]
push eax
push 0x129d6a4
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
push 0
mov dword [0x129d6a4], ecx
mov dword [0x129d6a8], edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x129d68c], eax
mov eax, dword [esi]
mov dword [0x44dd28], eax
mov ecx, dword [esi + 4]
mov dword [0x44dd2c], ecx
mov dx, word [esi + 8]
mov word [0x44dd30], dx
movzx eax, byte [esi + 1]
mov edx, esi
mov dword [0x129d694], eax
mov ecx, dword [esi + 3]
add edx, 7
mov dword [0x129d690], esi
mov dword [0x129d698], ecx
mov dword [0x129d69c], edx
cmp eax, 0xff
jne 0x4015e3
lea eax, [esp + 8]
push eax
push 0x40
push 5
push esi
call edi
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push eax
mov ecx, 0x401500
sub ecx, esi
push 5
sub ecx, 5
mov byte [esi], 0xe9
push esi
mov dword [esi + 1], ecx
call edi
add esi, 5
pop edi
mov dword [0x129d69c], esi
pop esi
add esp, 0x24
ret
lea ecx, [esp + 8]
push ecx
push 0x40
push 5
push esi
call edi
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov edx, 0x4014b0
sub edx, esi
push 5
sub edx, 5
mov byte [esi], 0xe9
push esi
mov dword [esi + 1], edx
call edi
pop edi
pop esi
add esp, 0x24
ret

Function at 0x401a40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.00406e41

Function at 0x401ab0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401ac9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401b04
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401b00
lea ebx, [ebx]
cmp esi, eax
jae 0x401b04
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401af0
cmp esi, eax
jb 0x401b0a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x403322
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], dl
lea esp, [esp + 4]
je 0x12a94cc
pushfd
inc ecx
test bh, dh
mov word [esp], dx
stc
pushal
cmp ecx, eax
pushfd
jmp fcn.012c8bda
rdtsc
pushal
mov byte [esp], 0xf1
pushfd
mov byte [ecx + 0x129c2f8], bl
lea esp, [esp + 0x24]
bswap dx
cwde
rdtsc
mov al, 2
mov eax, 0x129c2f8
bswap dx
bswap dx
pushal
pushfd
lea edx, [eax + 1]
lea esp, [esp + 0x24]
pushfd
mov cl, byte [eax]
push 0x68fa8279
call fcn.012d5dcb
Function at 0x405770
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x4057b8
call fcn.0040907d
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4057b8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4057fb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x4057e4
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4057e4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x4057f8
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40ede8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40ee2f
call fcn.0040907d
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40ee2f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40ee4b
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040e960
mov esi, eax
test edi, edi
je 0x40ee49
test ebx, ebx
je 0x40ee49
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4100bf
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x4366d0
call fcn.00421a74
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4100e4
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x41012a
lea ecx, [ebp - 0x10]
call fcn.00401f20
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040955b
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401ee0
mov eax, esi
call fcn.00421b4c
ret 8
Function at 0x4208c6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4477b0]
jne 0x4208d0
repz ret
jmp fcn.00426256

Function at 0x42f5c2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00425c65
and dword [ebp - 4], 0
cmp dword [0x44b550], 0
mov ebx, eax
jne 0x42f673
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42f724
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42f724
push eax
call fcn.00425bf3
mov dword [esp], 0x43c3d4
push edi
mov dword [0x44b550], eax
call esi
push eax
call fcn.00425bf3
mov dword [esp], 0x43c3c0
push edi
mov dword [0x44b554], eax
call esi
push eax
call fcn.00425bf3
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44b558], eax
call esi
push eax
call fcn.00425bf3
pop ecx
mov dword [0x44b560], eax
test eax, eax
je 0x42f673
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00425bf3
pop ecx
mov dword [0x44b55c], eax
mov eax, dword [0x44b55c]
cmp eax, ebx
je 0x42f6cb
cmp dword [0x44b560], ebx
je 0x42f6cb
push eax
call fcn.00425c6e
push dword [0x44b560]
mov esi, eax
call fcn.00425c6e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42f6cb
test edi, edi
je 0x42f6cb
call esi
test eax, eax
je 0x42f6c2
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42f6c2
test byte [ebp - 0xc], 1
jne 0x42f6cb
or dword [ebp + 0x10], 0x200000
jmp 0x42f704
mov eax, dword [0x44b554]
cmp eax, ebx
je 0x42f704
push eax
call fcn.00425c6e
pop ecx
test eax, eax
je 0x42f704
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42f704
mov eax, dword [0x44b558]
cmp eax, ebx
je 0x42f704
push eax
call fcn.00425c6e
pop ecx
test eax, eax
je 0x42f704
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44b550]
call fcn.00425c6e
pop ecx
test eax, eax
je 0x42f724
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42f726
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x12a896f
Capabilities:
Write file on windows

Disassembly:
mov dword [esp + 0x48], 0x129c2f8
push esp
mov byte [esp], 0x2d
push esp
lea esp, [esp + 0x50]
call fcn.00421465
push 0xb1415d59
jmp 0x12d19e6
pushal
lea esp, [esp + 0x20]
call fcn.00421287
cmc
bt edx, ebx
stc
add esp, 0x14
call fcn.012bf11e
jmp 0x12c4b5d
mov byte [esp], bl
mov dword [esp], esi
jmp 0x12c5657

Function at 0x12b3c92
Capabilities:
Write file on windows

Disassembly:
push dword [esp + 8]
lea esp, [esp + 0x3c]
call fcn.00421465
pushfd
jmp 0x12c147c
mov dword [esp + 0x34], 0x129c2f8
push 0x1c4ecdaf
jmp 0x12a2e1e
mov dword [esp], esi
pushfd
pushfd
lea esp, [esp + 8]
call fcn.00421287
bt di, 1
test dl, 0xe2
pushal
stc
add esp, 0x34
pushfd
pushal
pushal
mov dword [esp + 0x40], 0x129c2f8
pushfd
mov dword [esp + 0x40], 0x129fe4c
mov word [esp + 0x14], si
jmp 0x12d6976
Function at 0x12b4874
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0x14]
mov word [esp + 0x18], 0x22a3
lea esp, [esp + 0x4c]
je 0x12a94cc
pushfd
push ebp
inc ecx
push ebp
cmp ecx, eax
call fcn.012b950e

Function at 0x12bed06
Capabilities:
Read file on windows

Disassembly:
lea esp, [esp + 0x28]
call fcn.00420cc3
ja 0x12c9fdc
pushfd
mov dword [esp], edi
call fcn.012b5110
pushal
mov dword [esp + 0x1c], edi
mov byte [esp + 4], 0xaa
mov dword [esp + 0x18], 1
mov dword [esp], 0x7623aeae
jmp 0x12b0ff3

Function at 0x12c715c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
lea esp, [esp + 4]
call fcn.004261c0
pushfd
push dword [esp]
push dword [esp]
lea esp, [esp + 0xc]
jmp fcn.0042073f

Function at 0x12c8535
Capabilities:
Read file on windows

Disassembly:
mov dword [esp + 0x2c], 0x44e138
pushfd
mov dword [esp + 0xc], esp
push dword [esp + 4]
lea esp, [esp + 0x34]
call fcn.004211f3
pushal
mov word [esp + 4], di
call fcn.012cfa66

Function at 0x12d2c47
Capabilities:
Execute anti-debugging instructions

Disassembly:
test si, 0xee2c
cmp eax, ebx
jbe 0x12c2ca3
pushal
pushfd
lea esp, [esp + 0x24]
jle 0x12a94de
pushfd
lea esp, [esp + 4]
jle 0x12a94de
bt edi, edx
jmp 0x12d76df
bt si, 3
mov byte [esp], dl
test di, 0xbab6
sub eax, edx
stc
cmp eax, ebx
pushal
push 0xe387b521
lea esp, [esp + 0x28]
jle 0x12a94de
clc
clc
test ebx, 0x7e4624c5
xor ecx, ecx
cmp cx, dx
cmp bx, cx
jmp 0x12aae4f
stc
cmp byte [ecx + 0x129c2f8], bl
call fcn.00403322

Function at 0x12d5402
Capabilities:
Read file on windows

Disassembly:
mov dword [esp + 0x28], 1
jmp 0x12c6fe2
Function at 0x10001af0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x10001b41
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
inc ebp
jecxz 0x10001b6d
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77

Function at 0x10001d30
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x10001d5a
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x10001d55
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x10001d3f
and ecx, 0xfff
add byte [eax], al
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x10001d47
cmp edx, ebx
jne 0x10001e95
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x10001d16
add eax, dword [eax + 4]
jmp 0x10001d03
mov dword [ebp + 0xc], ebx
jmp 0x10001d65
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x10001d7d
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10001d9b
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10001df9
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10001de0
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10001de9
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10001df3
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10001dd5
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10001d5f
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10001e46
dec eax
je 0x10001e3d
sub eax, 3
je 0x10001e34
mov dword [ebp - 4], 0x40
jmp 0x10001e63
mov dword [ebp - 4], 4
jmp 0x10001e49
mov dword [ebp - 4], 0x20
jmp 0x10001e49
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10001e95
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10001e15
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.100016a6
imul esp, dword [esi], 0x75ffcb9e
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x10001ea1
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret