joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407934
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4079d1
push ebx
push esi
call fcn.004078fd
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00407846
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40797e
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4079d0
push edi
push eax
call fcn.00408534
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40799e
call fcn.00406431
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4079cf
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00407846
add esp, 0x20
test eax, eax
jne 0x4079bd
push edi
call fcn.00406431
jmp 0x4079c5
push ebx
call fcn.00406431
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x408cb7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410f98
push 0x410f90
push str.FlsAlloc
push 0x1e
call fcn.00408b78
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408ceb
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f10c]
call esi
jmp 0x408cf1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x408d35
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410fa8
push 0x410fa0
push str.FlsGetValue
push 0x20
call fcn.00408b78
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408d6c
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f10c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40e1f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40e21d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40e21d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40a873
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40a882
pop dword [ebp - 0x4c]
mov eax, 0xd12b941a
sub eax, 0xd0eaeb98
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x382ab
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0xf59404cf
sub ecx, 0xf593c0ff
xor edi, edi
add edi, eax
mov esi, 0x207323c0
sub esi, 0x2031e7fc
add esi, dword [ebp - 0x4c]
mov ebx, 0x7cce4ef0
add ebx, 0xccf1501c
mov edx, dword [esi]
add dword [ebp - 0x2c], eax
xor edx, ebx
add dword [ebp - 0x10], 0x77433109
mov dword [edi], edx
sub dword [ebp - 0x18], esi
add edi, 0xb29ce378
add edi, 0x4d631c8c
add esi, 4
loop 0x40a8de
add eax, 0x6556d1f3
add eax, 0x9aaa3020
xor ebx, ebx
add ebx, eax
add eax, 0xb6d3c01e
sub eax, 0xb6d3c019
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x410f5c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42104c]
jne 0x413fe3
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x422720], eax
mov dword [0x42271c], ecx
mov dword [0x422718], edx
mov dword [0x422714], ebx
mov dword [0x422710], esi
mov dword [0x42270c], edi
mov word [0x422738], ss
mov word [0x42272c], cs
mov word [0x422708], ds
mov word [0x422704], es
mov word [0x422700], fs
mov word [0x4226fc], gs
pushfd
pop dword [0x422730]
mov eax, dword [ebp]
mov dword [0x422724], eax
mov eax, dword [ebp + 4]
mov dword [0x422728], eax
lea eax, [ebp + 8]
mov dword [0x422734], eax
mov eax, dword [ebp - 0x320]
mov dword [0x422670], 0x10001
mov eax, dword [0x422728]
mov dword [0x422624], eax
mov dword [0x422618], 0xc0000409
mov dword [0x42261c], 1
mov eax, dword [0x42104c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x421050]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x422668], eax
push 1
call fcn.00415efd
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x402cf0
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x422668], 0
jne 0x4140cf
push 1
call fcn.00415efd
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x417b1a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x417b29
pop dword [ebp - 0x14]
mov eax, 0xc6066931
add eax, 0x3a3b11f8
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3c95e
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x5816e09f
add ecx, 0xa7e96edd
xor edx, edx
add edx, eax
mov esi, 0xd2ff49f4
add esi, 0x2d432c0c
add esi, dword [ebp - 0x14]
mov ebx, 0xfa32ded9
xor dword [ebp - 0x10], 0x5f160900
mov edi, dword [esi]
mov dword [ebp - 8], 0x2c7c570d
sub edi, ebx
add dword [ebp - 4], 0x21d0bdd6
mov dword [edx], edi
add dword [ebp - 0xc], 0xc1d62596
add edx, 0xa18ead3e
sub edx, 0xa18ead3a
add esi, 4
loop 0x417b7f
add eax, 0x6520092
add eax, 0xf9af3031
mov ebx, eax
add eax, 0xf46c16b4
sub eax, 0xf46c16af
mov ecx, 0x241ca31f
add ecx, 0xdc235ce1
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x1000b6d5
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x1001ff00]
xor eax, esp
mov dword [esp + 0x104], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x118]
lea eax, [esp + 0xc]
mov ebp, 0x104
xor esi, esi
push ebp
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000b738
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x1000b772
push ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1000b772
lea eax, [esp + 0xc]
push 0x10017e60
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
lea eax, [esp + 0x14]
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 0x10
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
mov ecx, dword [esp + 0x110]
mov eax, esi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10014785
add esp, 0x108
ret

Function at 0x1000e6a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1000e6af
pop dword [ebp - 0x38]
mov eax, 0x9051b4e6
add eax, 0x7faf31c9
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x7a38295d
add dword [ebp - 0x48], 0xd41a1bee
mov dword [ebp - 0x44], 0x87c2045d
add dword [ebp - 0x44], 0xaa7147e8
mov dword [ebp - 0x40], 0x6bcbf6f0
sub dword [ebp - 0x40], 0x1f7fb2c2
mov dword [ebp - 0x3c], 0x52f917f3
sub dword [ebp - 0x3c], 0x52f917f3
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x697f359b
sub dword [ebp - 0x48], 0xf50ccc45
mov dword [ebp - 0x44], 0x97afd95
sub dword [ebp - 0x44], 0xc80e9c20
mov dword [ebp - 0x40], 0xca702111
sub dword [ebp - 0x40], 0x6700b4a5
mov dword [ebp - 0x3c], 0x3e460926
sub dword [ebp - 0x3c], 0x3e460926
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x7ba770ac
add eax, 0x9459efb8
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x36b57
push 0
call eax
mov ecx, 0xdb325c9
sub ecx, 0xdb2e24e
xor ebx, ebx
add ebx, eax
mov esi, 0x10023600
add esi, dword [ebp - 0x38]
mov edx, 0xe36509be
add edx, 0xcc9d0971
mov dword [ebp - 0x18], 0x990b41a9
mov edi, dword [esi]
xor dword [ebp - 0x28], edx
sub edi, edx
xor dword [ebp - 0xc], 0x6c3c92e0
mov dword [ebx], edi
sub dword [ebp - 4], 0x3389916
add ebx, 0x3954fb6f
sub ebx, 0x3954fb6b
add esi, 0xa657541a
sub esi, 0xa6575416
loop 0x1000e7c8
add eax, 0x1164c2a4
add eax, 0xee9c3e1b
mov ebx, eax
add eax, 5
mov ecx, 0x63e8f7b6
add ecx, 0xac17084a
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x1001cc37
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x1001ccba
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1001cc84
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1001cc84
cmp edi, ebx
jge 0x1001cc84
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1001ccb4
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1001ccb4
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x1001cccc
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc

Function at 0x1001cf62
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
cmp byte [0x100269c0], al
je 0x1001cf99
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cffd
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10011e6e
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10011e6e
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.10011e6e
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ddeb
leave
ret 0x10

Function at 0x1001d00e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d03a
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d06b
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d069
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10011e6e
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d06b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001ddeb
leave
ret 8
Function at 0x1001d106
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
mov eax, dword [ebp + 8]
je 0x1001d12e
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001d148
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10011e6e
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1001ddeb
leave
ret 4

Function at 0x1001ddeb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100268b0]
jne 0x1001ddf5
repz ret
jmp fcn.1001e62c
Function at 0x40dedb
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a538]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408cd1
mov dword [ebp - 0x14], eax
cmp dword [0x4aebbc], esi
jne 0x40dfce
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40df5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40e0ae
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40e0ae
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e0ae
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4aebbc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4aebc0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4aebc4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4aebcc], eax
test eax, eax
je 0x40dfcb
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4aebc8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40dff3
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40dfe6
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40e008
push 4
pop eax
jmp 0x40e0b0
cmp dword [ebp - 0x14], esi
je 0x40e008
push dword [0x4aebbc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40dfed
mov eax, dword [0x4aebc8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40e066
cmp dword [0x4aebcc], edi
je 0x40e066
push eax
call ebx
push dword [0x4aebcc]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40e066
test eax, eax
je 0x40e066
call ecx
test eax, eax
je 0x40e05b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40e05b
test byte [ebp - 8], 1
jne 0x40e066
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40e096
mov eax, dword [0x4aebc0]
cmp eax, edi
je 0x40e093
push eax
call ebx
test eax, eax
je 0x40e093
call eax
mov esi, eax
test esi, esi
je 0x40e093
mov eax, dword [0x4aebc4]
cmp eax, edi
je 0x40e093
push eax
call ebx
test eax, eax
je 0x40e093
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4aebbc]
call ebx
test eax, eax
je 0x40e0ae
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40e0b0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404293
mov esp, ebp
pop ebp
ret
Function at 0x40c31d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x418538]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004097a3
mov dword [ebp - 0x14], eax
cmp dword [0x44b198], esi
jne 0x40c410
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c39d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c4f0
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c4f0
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c4f0
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x44b198], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x44b19c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x44b1a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44b1a8], eax
test eax, eax
je 0x40c40d
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44b1a4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c435
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c428
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c44a
push 4
pop eax
jmp 0x40c4f2
cmp dword [ebp - 0x14], esi
je 0x40c44a
push dword [0x44b198]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c42f
mov eax, dword [0x44b1a4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c4a8
cmp dword [0x44b1a8], edi
je 0x40c4a8
push eax
call ebx
push dword [0x44b1a8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c4a8
test eax, eax
je 0x40c4a8
call ecx
test eax, eax
je 0x40c49d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c49d
test byte [ebp - 8], 1
jne 0x40c4a8
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c4d8
mov eax, dword [0x44b19c]
cmp eax, edi
je 0x40c4d5
push eax
call ebx
test eax, eax
je 0x40c4d5
call eax
mov esi, eax
test esi, esi
je 0x40c4d5
mov eax, dword [0x44b1a0]
cmp eax, edi
je 0x40c4d5
push eax
call ebx
test eax, eax
je 0x40c4d5
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x44b198]
call ebx
test eax, eax
je 0x40c4f0
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c4f2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004042ed
mov esp, ebp
pop ebp
ret
Function at 0x1001aa37
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1001aa46
pop dword [ebp - 0x18]
mov eax, 0xe0c51e0a
add eax, 0x2f3c8c3c
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xd298617c
add dword [ebp - 0x28], 0x7bb9e3cf
mov dword [ebp - 0x24], 0x9b23c210
add dword [ebp - 0x24], 0x970f8a35
mov dword [ebp - 0x20], 0xd1c69b83
add dword [ebp - 0x20], 0x7a85a8ab
mov dword [ebp - 0x1c], 0xdd991a25
add dword [ebp - 0x1c], 0x2266e5db
lea eax, [ebp - 0x28]
push eax
mov eax, 0x41ee57a5
sub eax, 0x31ea46cd
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x4e265ee7
add dword [ebp - 0x28], 0x264c0a6f
mov dword [ebp - 0x24], 0x80214a35
sub dword [ebp - 0x24], 0x3eb4e8c0
mov dword [ebp - 0x20], 0x36690925
add dword [ebp - 0x20], 0x2d066347
mov dword [ebp - 0x1c], 0x9c3be426
add dword [ebp - 0x1c], 0x63c41bda
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xb9724daa
sub eax, 0xa96e3d32
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x4a8c6
push 0
call eax
mov ecx, 0xfb7f0340
add ecx, 0x48138e8
mov esi, eax
mov edx, 0xbc7f2a5b
sub edx, 0xac7a405b
add edx, dword [ebp - 0x18]
mov ebx, 0x2ae7bff
add ebx, 0xdb5fb29f
sub dword [ebp - 8], 0x8cc7b295
mov edi, dword [edx]
add dword [ebp - 0x14], edi
xor edi, ebx
sub dword [ebp - 8], edx
mov dword [esi], edi
xor dword [ebp - 0x10], 0x3fab0e7f
add esi, 4
add edx, 4
loop 0x1001ab68
add eax, 0xe373
mov ebx, eax
add eax, 0x47cc7c3e
add eax, 0xb83383c7
mov ecx, 0x46e5a0bd
sub ecx, 0x36e5a0bd
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x1003f584
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004acd0]
jne 0x1003f58e
repz ret
jmp fcn.1003fc70
Function at 0x402b70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
call section..text
push 0x404f1c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.00403920
test eax, eax
je 0x402bb1
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004021b0
call fcn.004020c0
push 0
push str.____AVP.Root
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x402be6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x10001
push 0x466
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
call fcn.00402340
call fcn.00402430
call fcn.00402520
call fcn.00402660
mov edi, dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
call edi
test eax, eax
jne 0x402c17
call fcn.004033b0
test eax, eax
je 0x402c17
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call edi
push 0x4045b8
mov ebx, eax
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x402c50
push 0x4045c8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x402c50
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 8], 0
je 0x402ca2
test ebx, ebx
je 0x402c70
push str._apppatch_
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x402c93
lea esi, [ebp - 0x10c]
call fcn.00401130
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.00401b70
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402db4
call fcn.004028b0
jmp loc.0045f000
test ebx, ebx
je 0x402d59
push str._apppatch_
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x402cfd
lea esi, [ebp - 0x10c]
call fcn.00401130
push 0x404ea0
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
test ax, ax
jne 0x402db4
push 0x404ea0
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
call edi
test eax, eax
je 0x402d95
lea ecx, [ebp - 1]
push ecx
jmp 0x402d89
call fcn.004028b0
push 0x404ea0
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
test ax, ax
jne 0x402d52
push 0x404ea0
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
call edi
test eax, eax
je 0x402d33
lea edx, [ebp - 1]
push edx
push 0
push 1
push 0x14
call dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
call edi
test eax, eax
mov eax, 0x404ebc
jne 0x402d43
mov eax, 0x404ecc
push eax
call fcn.00401aa0
test eax, eax
je 0x402d52
call fcn.00401b70
call fcn.00401520
jmp 0x402db4
lea esi, [ebp - 0x10c]
call fcn.00401130
push 0x404ea0
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
test ax, ax
jne 0x402db4
push 0x404ea0
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
call edi
test eax, eax
je 0x402d95
lea eax, [ebp - 1]
push eax
push 0
push 1
push 0x14
call dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
call edi
test eax, eax
mov eax, 0x404ebc
jne 0x402da5
mov eax, 0x404ecc
push eax
call fcn.00401aa0
test eax, eax
je 0x402db4
call fcn.00401b70
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x403ad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, 0xffffffff
test ecx, ecx
mov esi, dword [ebp + 8]
je 0x403af9
xor al, byte [esi]
movzx edx, al
shr eax, 8
mov edx, dword [edx*4 + section..data]
inc esi
xor eax, edx
dec ecx
jne 0x403ae4
xor eax, 0xffffffff
pop esi
leave
ret 0xc

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219