joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4029b6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x824
mov eax, dword [0x4152ac]
xor eax, esp
mov dword [esp + 0x820], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp byte [eax + 0x1c], bl
push esi
push edi
mov dword [esp + 0x20], eax
je 0x402a9a
cmp dword [eax + 0x18], 0xffffffff
mov esi, dword [0x411050]
jne 0x40293f
push 0x206
lea eax, [esp + 0x2e]
push ebx
push eax
mov word [esp + 0x34], bx
call fcn.00404400
xor eax, eax
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov word [esp + 0x14], bx
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov word [esp + 0x22], ax
call esi
movzx edx, word [esp + 0x1a]
movzx eax, word [esp + 0x18]
movzx ecx, word [esp + 0x16]
push edx
movzx edx, word [esp + 0x16]
push eax
push ecx
push edx
push 0x413564
mov eax, 0x208
lea edi, [esp + 0x3c]
call fcn.00401430
add esp, 0x14
push ebx
push 0x80
push 1
push ebx
push ebx
push 0x40000000
mov eax, edi
push eax
call dword [0x41106c]
cmp eax, 0xffffffff
mov ecx, dword [esp + 0x20]
mov dword [ecx + 0x18], eax
jne 0x40293f
or eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x820]
xor ecx, esp
call fcn.0040320a
mov esp, ebp
pop ebp
ret
push 0x3fe
lea edx, [esp + 0x42e]
push ebx
push edx
mov word [esp + 0x434], bx
call fcn.00404400
mov ecx, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
push ecx
push 0x1ff
lea edx, [esp + 0x440]
push 0x200
push edx
call fcn.00403a38
add esp, 0x20
cmp eax, ebx
jl 0x402a9a
cmp eax, 0x1ff
ja 0x402a9a
jne 0x402999
mov word [esp + 0x826], bx
push 0x3fe
lea eax, [esp + 0x2e]
push ebx
push eax
mov word [esp + 0x34], bx
call fcn.00404400
xor eax, eax
add esp, 0xc
lea ecx, [esp + 0x10]
adc byte [ecx + 0x66], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x16], eax
mov dword [esp + 0x1a], eax
mov dword [esp + 0x1e], eax
mov word [esp + 0x22], ax
call esi
movzx eax, word [esp + 0x1c]
movzx ecx, word [esp + 0x1a]
lea edx, [esp + 0x428]
push edx
movzx edx, word [esp + 0x1c]
push eax
movzx eax, word [esp + 0x1e]
push ecx
movzx ecx, word [esp + 0x1e]
push edx
push eax
push ecx
push 0x413590
mov eax, 0x400
lea edi, [esp + 0x44]
call fcn.00401430
add esp, 0x1c
mov ecx, 0x200
mov eax, edi
cmp word [eax], bx
je 0x402a22
add eax, 2
sub ecx, 1
jne 0x402a13
jmp 0x402a42
cmp ecx, ebx
je 0x402a42
mov eax, 0x200
sub eax, ecx
mov edx, 0x200
sub edx, eax
lea ecx, [esp + eax*2 + 0x28]
mov eax, 0x4135b8
call fcn.00401020
lea eax, [esp + 0x28]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x402a50
sub eax, edx
push ebx
sar eax, 1
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x28]
add eax, eax
push eax
mov eax, dword [edx + 0x18]
lea ecx, [esp + 0x34]
push ecx
push eax
mov dword [esp + 0x38], ebx
call dword [0x41107c]
neg eax
sbb eax, eax
neg eax
pop edi
mov ecx, dword [esp + 0x82c]
pop edi
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x50f238e5
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x55da40c2
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x405a12
pop dword [ebp - 0x40]
mov eax, 0x4ed64d00
add eax, 0xb16a0d12
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xabd9544f
sub dword [ebp - 0x50], 0x5d870f04
mov dword [ebp - 0x4c], 0x8ceba2b1
add dword [ebp - 0x4c], 0xa547a994
mov dword [ebp - 0x48], 0x646574d2
sub dword [ebp - 0x48], 0x181930a4
mov dword [ebp - 0x44], 0x4cc5774
sub dword [ebp - 0x44], 0x4cc5774
lea eax, [ebp - 0x50]
push eax
mov eax, 0xe9f7e9f7
sub eax, 0xe9b768f3
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x634ecf91
add dword [ebp - 0x50], 0x112399c5
mov dword [ebp - 0x4c], 0x3100310a
sub dword [ebp - 0x4c], 0xef93cf95
mov dword [ebp - 0x48], 0x49a3d07c
sub dword [ebp - 0x48], 0xe6346410
mov dword [ebp - 0x44], 0x8b42f9b6
add dword [ebp - 0x44], 0x74bd064a
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x375e8
push 0
call eax
mov ecx, 0xad886861
sub ecx, 0xad881ed3
mov ebx, eax
mov esi, 0x82b9344f
sub esi, 0x8272504f
add esi, dword [ebp - 0x40]
mov edi, 0x72ee19f
sub dword [ebp - 0x28], 0xcd7242e5
mov edx, dword [esi]
sub dword [ebp - 4], ebx
add edx, edi
mov dword [ebp - 0x38], 0xd23f5076
mov dword [ebx], edx
xor dword [ebp - 4], edx
add ebx, 0xe93b2ecd
sub ebx, 0xe93b2ec9
add esi, 4
loop 0x405b29
add eax, 0xb7692e24
add eax, 0x4897eae7
xor ebx, ebx
add ebx, eax
add eax, 0x83035ed7
sub eax, 0x83035ed2
mov ecx, 0xeb4624db
add ecx, 0x14f9db25
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x403480
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403499
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4034d4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4034d0
lea ebx, [ebx]
cmp esi, eax
jae 0x4034d4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4034c0
cmp esi, eax
jb 0x4034da
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x404a10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x55c
mov eax, dword [0x45b738]
xor eax, esp
mov dword [esp + 0x554], eax
cmp dword [0x46019c], 0
mov dword [esp], 0
je 0x404a57
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x46019c]
cmp dword [esp], 0
je 0x404a57
lea ecx, [esp + 4]
push ecx
push str.SoftwareWow6432NodeUkrgaztechORACLE
jmp 0x404a61
lea edx, [esp + 4]
push edx
push str.SoftwareUkrgaztechORACLE
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x404a87
xor al, al
mov ecx, dword [esp + 0x554]
xor ecx, esp
call fcn.00428ac7
add esp, 0x55c
ret
push 0x3ff
lea eax, [esp + 0x155]
push 0
push eax
mov dword [esp + 0x18], 1
mov byte [esp + 0x15c], 0
call fcn.0042b0d0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x154]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push str.ORACLE_HOME
push ecx
mov dword [esp + 0x20], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x404a70
lea edx, [esp + 0x150]
push edx
push str._s_tnsnames.ora
push esi
call fcn.004298ae
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [esp + 0x554]
cmp eax, 0xffffffff
setne al
xor ecx, esp
call fcn.00428ac7
add esp, 0x55c
ret
Function at 0x408940
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x446b82
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x45b738]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [edi], 0x44fab0
mov dword [edi + 0x58], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 8]
push esi
mov dword [esp + 0x24], ebx
push edi
mov dword [esp + 0x1c], 1
call fcn.00409df0
mov dword [esp + 0x20], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.0040abd0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x4601b0]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, dword [esp + 0x2c]
push eax
mov ecx, esi
mov byte [esp + 0x24], 2
call fcn.0040a130
test eax, eax
jne 0x408a43
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + edi + 8]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x28], ebx
jne 0x408a32
or eax, 4
and eax, 0x17
test dword [ecx + 0xc], eax
mov dword [ecx + 8], eax
je 0x408a43
push ebx
call fcn.00403f80
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x40abd0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x445c8b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x45b738]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004433c4
push 4
mov dword [esp + 0x20], 0
call fcn.0040ca1b
mov edi, eax
add esp, 4
test edi, edi
je 0x40ac50
call fcn.00442fbc
mov dword [edi], eax
call fcn.00442df0
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00442d62
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40ac45
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00442d83
jmp 0x40ac52
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x40dc0c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x40dc52
call fcn.004163f2
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40dc52
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x40dc95
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x40dc7e
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x40dc7e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x40dc92
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x413f8c
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x413fc5
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0040f3a5
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0040b6d0
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]
Function at 0x415aa2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x415ae5
call fcn.004163f2
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x415ae5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x415b00
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0041565c
test ebx, ebx
mov esi, eax
je 0x415afe
test edi, edi
je 0x415afe
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x418cb1
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 8], 0
push esi
mov esi, ecx
jne 0x418cba
xor eax, eax
jmp 0x418d23
cmp dword [esp + 8], 0
jne 0x418cc6
call fcn.00418677
push edi
push dword [esi + 0x10]
push dword [esp + 0x14]
push 1
push dword [esp + 0x18]
call fcn.0042da37
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x418d01
push dword [esi + 0x10]
call fcn.0042d77c
test eax, eax
pop ecx
jne 0x418d01
mov esi, dword [esi + 0xc]
call fcn.0042b09a
push esi
push dword [eax]
push 1
call fcn.00425b3c
push dword [esi + 0x10]
call fcn.0042d7ab
test eax, eax
pop ecx
je 0x418d20
push dword [esi + 0x10]
call fcn.0042d6d0
push eax
call fcn.004034f0
pop ecx
pop ecx
jmp 0x418cef
mov eax, edi
pop edi
pop esi
ret 8

Function at 0x418d2c
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 4], 0
push esi
mov esi, ecx
jne 0x418d36
call fcn.00418677
push dword [esi + 0x10]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call fcn.0042a0d6
add esp, 0x10
cmp eax, dword [esp + 0xc]
je 0x418d63
mov esi, dword [esi + 0xc]
call fcn.0042b09a
push esi
push dword [eax]
push 1
call fcn.00425b3c
pop esi
ret 8

Function at 0x419b54
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x419b82
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x419ba0
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00419abe
jmp 0x419ba0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x419ba0
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00419abe
test edi, edi
mov eax, edi
jne 0x419b8a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x45ec08]
test ecx, ecx
je 0x419c63
jmp 0x419b53
ret 8

Function at 0x428ac7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45b738]
jne 0x428ad1
repz ret
jmp fcn.0042ff14
Function at 0x43a9e2
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0042f8fb
xor ebx, ebx
cmp dword [0x45fa78], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x43aab7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x43aa22
xor eax, eax
jmp 0x43ab7b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x43aa1b
push eax
call fcn.0042f898
mov dword [esp], 0x44cbb4
push edi
mov dword [0x45fa78], eax
call esi
push eax
call fcn.0042f898
mov dword [esp], 0x44cba0
push edi
mov dword [0x45fa7c], eax
call esi
push eax
call fcn.0042f898
mov dword [0x45fa80], eax
lea eax, [ebp - 8]
push eax
call fcn.00429d5d
test eax, eax
pop ecx
pop ecx
je 0x43aa85
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00429185
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x43aab7
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0042f898
cmp eax, ebx
pop ecx
mov dword [0x45fa88], eax
je 0x43aab7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042f898
pop ecx
mov dword [0x45fa84], eax
mov eax, dword [0x45fa84]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x43ab30
cmp dword [0x45fa88], esi
je 0x43ab30
push eax
call fcn.0042f904
pop ecx
call eax
cmp eax, ebx
je 0x43aafd
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x45fa88]
call fcn.0042f904
pop ecx
call eax
test eax, eax
je 0x43aafd
test byte [ebp - 0x18], 1
jne 0x43ab30
lea eax, [ebp - 0xc]
push eax
call fcn.00429d94
test eax, eax
pop ecx
je 0x43ab18
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00429185
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x43ab27
or dword [ebp + 0x10], 0x200000
jmp 0x43ab61
or dword [ebp + 0x10], 0x40000
jmp 0x43ab61
mov eax, dword [0x45fa7c]
cmp eax, esi
je 0x43ab61
push eax
call fcn.0042f904
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x43ab61
mov eax, dword [0x45fa80]
cmp eax, esi
je 0x43ab61
push dword [ebp - 4]
push eax
call fcn.0042f904
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x45fa78]
call fcn.0042f904
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x443856
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x45b738]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004437eb
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0042b0d0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4438a5
cmp dword [ebp - 0x1c], 5
jb 0x4438bd
jmp 0x4438b9
cmp dword [ebp - 0x10], 1
jne 0x4438bd
cmp dword [ebp - 0x1c], 4
ja 0x4438b9
jne 0x4438bd
cmp dword [ebp - 0x18], 0
jbe 0x4438bd
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x44edf0
call fcn.004436bf
test eax, eax
jge 0x4438de
mov byte [0x4601a8], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00428ac7
add ebp, 0x78
leave
ret

Function at 0x401790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa3b8
mov eax, dword [0x410278]
test eax, eax
test byte [ecx + esi*4 + 0x41], 0
je 0x4017bb
push 0x413c40
push eax
call 0x537050
mov cx, word [0x410274]
insb byte es:[edi], dx
xor ecx, dword [ebx + 0x4118bd15]
add byte [edx + 0x50], dl
mov edx, dword [0x4118bd]
push edx
push eax
sbb dword [eax + 0x7b000040], ecx
mov ecx, dword [0x4117f4]
mov dword [0x411808], eax
mov eax, dword [0x410288]
push ebx
dec edi
push edx
xor eax, sym.imp.MSVCRT.dll_printf
push eax
mov dword [eax - 0x4c], ebp
or ebp, dword [ecx]
test eax, eax
push edi
jne 0x4017c1
pop es
adc eax, 0x84140700
push edx
push str.Benchmarking__s
call esi
mov eax, dword [0x410278]
add esp, 0xffffff88
test eax, eax
je 0x401802
mov byte [ebp - 0x5e048b40], al
je 0x40180c
mov eax, dword [0x410274]
inc ecx
add dl, cl
push 0x413c40
push 0x40f222
jmp [edx - 0x31]
retf 0x4068
Function at 0x4ee180
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 0xb]
mov word [esp + 4], sp
lea esp, [esp + 1]
mov dword [esp + 0x78], edi
lea esp, [esp + 0x78]
jmp 0x4ee26f
jae 0x4ee1f7
jb 0x4ee1f7
rdtsc
setg ch
or cx, 0x7600
mov ecx, ebp
lea ebx, reloc.kernel32.dll_DeleteCriticalSection
xchg dh, dl
call fcn.004ee22a
popal
cld
xchg edx, eax
cmc
add al, 0xc5
dec ecx
call 0xecd08404
rol byte [eax], 0
add byte [ebx + 0x8ec83f4], cl
sub esp, 0xc0
mov esi, esp
sub esp, 8
jmp 0x4ee240
or cx, 0x7600
jmp 0x4ee1de
lea edi, [esp]
mov cx, word [esp]
xchg ecx, eax
rdtsc
xor dl, ch
jmp 0x4ee1d0
jno 0x4ee1d4
rdtsc
setg ch
jmp 0x4ee204
mov ebp, dword [esp + 0x28]
lea ecx, [ecx*4]
cpuid
cpuid
lea ecx, [edx + ebx]
jmp 0x4ee21c
pushfd
lea ecx, reloc.kernel32.dll_DeleteCriticalSection
mov ecx, eax
mov cl, 0x12
mov al, 0x76
jmp 0x4ee257

Function at 0x50cfa6
Capabilities:
Encrypt data using aes

Disassembly:
lea edx, [edx*4]
lea edx, reloc.kernel32.dll_DeleteCriticalSection
mov eax, dword [edx]
pop edx
jmp 0x50cf7b
lea esp, [esp + 0xc]
popal
jmp 0x50cf53