joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006853
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
inc dword [ebx]

Function at 0x10006af0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.10005f32
add esp, 0xc
mov dword [ebp - 0x67c], eax
invalid
movsd dword es:[edi], dword [esi]

Function at 0x10007f14
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp - 0x3a4], 0
je 0x10007f50
lea eax, [ebp - 0x714]
push eax
call fcn.10005f7d
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.10005f32
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jne 0x10007f50
jmp fcn.1000790f
cmp dword [ebp - 0x37c], 0
je 0x10007f5e
jmp 0x10008013
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
invalid
Function at 0x4017b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x41b0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x114]
add ecx, 8
call fcn.00401660
mov ecx, dword [ebp - 0x114]
mov edx, dword [ecx + 4]
push edx
mov ecx, dword [ebp - 0x114]
add ecx, 8
call fcn.004018f0
push 0
mov ecx, dword [ebp - 0x114]
add ecx, 8
call fcn.00401600
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00402b2d
add esp, 0xc
lea ecx, [ebp - 0x110]
push ecx
mov ecx, dword [ebp - 0x114]
add ecx, 0x10
call fcn.00401610
mov edx, dword [ebp - 0x114]
mov eax, dword [edx + 0x28]
push eax
mov ecx, dword [ebp - 0x114]
mov edx, dword [ecx + 0x20]
push edx
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax + 0x18]
push ecx
mov ecx, dword [ebp - 0x114]
add ecx, 8
call fcn.00401600
push eax
call fcn.00401f20
add esp, 0x10
test eax, eax
jne 0x401865
xor eax, eax
jmp 0x4018d4
mov edx, dword [ebp - 0x114]
cmp dword [edx + 0x2c], 0
je 0x4018cf
mov eax, dword [ebp - 0x114]
cmp dword [eax + 0x1c], 0
je 0x4018cf
mov ecx, dword [ebp - 0x114]
mov edx, dword [ecx + 0x28]
push edx
mov eax, dword [ebp - 0x114]
mov ecx, dword [eax + 0x24]
push ecx
mov edx, dword [ebp - 0x114]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp - 0x114]
add ecx, 0x10
call fcn.00401600
push eax
call fcn.00401f20
add esp, 0x10
test eax, eax
jne 0x4018cf
mov ecx, dword [ebp - 0x114]
add ecx, 8
call fcn.00401600
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
jmp 0x4018d4
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040522b
mov esp, ebp
pop ebp
ret 4

Function at 0x401b90
Capabilities:
Query environment variable
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x528
mov eax, dword [0x41b0b0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x528]
push eax
push 0
mov ecx, 0x41c1e0
call fcn.00402000
test eax, eax
je 0x401c86
push 0x104
lea ecx, [ebp - 0x528]
push ecx
lea edx, [ebp - 0x528]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x401c86
push str._c_start__wait
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x528]
push ecx
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str._1000__del
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x528]
push ecx
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x104
lea eax, [ebp - 0x110]
push eax
push str.ComSpec
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x401c5f
push str.cmd.exe
lea ecx, [ebp - 0x110]
push ecx
call fcn.00404ff0
add esp, 8
push 0
push 0
push 0
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.00402cf9
add esp, 0x14
test eax, eax
je 0x401c86
mov eax, 1
jmp 0x401c88
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040522b
mov esp, ebp
pop ebp
ret
Function at 0x401f20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x18], 0
mov ecx, 0x41c1dc
call fcn.004023e0
test eax, eax
je 0x401f56
push 0
lea eax, [ebp - 0x18]
push eax
push 1
push str.D:_D_OICI_FA___AN__A_OICI_FA___BG__A_OICI_FA___SY__A_OICI_FA___LS__A_OICI_FA___AU__A_OICI_FA___BA_
mov ecx, dword [0x41c1dc]
call fcn.00402390
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0xc
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
push 0
mov edx, dword [ebp + 0x14]
push edx
push 2
lea eax, [ebp - 0x14]
push eax
push 0
push 0x40000000
mov ecx, dword [ebp + 8]
push ecx
mov ecx, 0x41c1e0
call fcn.004022d0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401f98
xor eax, eax
jmp 0x401fef
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov ecx, 0x41c1e0
call fcn.00402330
test eax, eax
jne 0x401fd0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
jmp 0x401fef
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x18], 0
je 0x401fea
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x402b2d
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x30
push edi
mov edi, dword [ebp + 8]
cmp edi, eax
je 0x402b4c
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x402b42
push esi
push 0x2f
push edi
call fcn.00405e80
push 0x5c
push edi
mov esi, eax
call fcn.00405e80
add esp, 0x10
cmp eax, esi
jbe 0x402b68
mov esi, eax
test esi, esi
jne 0x402bc7
mov esi, edi
jmp 0x402bc8
mov al, byte [esi]
cmp al, 0x2e
je 0x402bcd
mov cl, al
sub cl, 0x30
cmp cl, 9
ja 0x402b91
movsx eax, al
sub eax, 0x2b
push 0xa
cdq
pop ecx
idiv ecx
add dl, 0x30
jmp 0x402bc5
mov cl, al
sub cl, 0x61
cmp cl, 0x19
ja 0x402bac
movsx eax, al
sub eax, 0x54
push 0x1a
cdq
pop ecx
idiv ecx
add dl, 0x61
jmp 0x402bc5
mov cl, al
sub cl, 0x41
cmp cl, 0x19
ja 0x402bc7
movsx eax, al
sub eax, 0x34
push 0x1a
cdq
pop ecx
idiv ecx
add dl, 0x41
mov byte [esi], dl
inc esi
cmp byte [esi], 0
jne 0x402b70
cmp dword [ebp + 0x10], 0
pop esi
je 0x402bf2
lea eax, [ebp - 0x30]
push eax
push edi
call fcn.00406bdd
pop ecx
pop ecx
test eax, eax
je 0x402bf2
call fcn.00406aba
cmp dword [eax], 2
jne 0x402bf2
xor eax, eax
jmp 0x402bf5
xor eax, eax
inc eax
pop edi
leave
ret

Function at 0x402f53
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41b0b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov ecx, 0x41c1dc
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call fcn.00402410
test eax, eax
je 0x402ff2
mov ecx, dword [0x41c1dc]
cmp dword [ecx + 4], ebx
je 0x402ff2
push esi
lea esi, [ecx + 0x14]
cmp dword [esi], ebx
jne 0x402fae
push 0xec67bab1
call fcn.00402050
mov dword [esi], eax
cmp eax, ebx
jne 0x402fae
xor eax, eax
jmp 0x402fc7
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [esi]
mov dword [ebp - 0x10], eax
pop esi
cmp eax, ebx
je 0x402ff2
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x402fe4
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
jmp 0x402ff4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040522b
leave
ret
Function at 0x40344d
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0x28
mov eax, 0x4145f1
call fcn.00406a1f
mov ebx, dword [ebp + 8]
or dword [ebp - 0x1c], 0xffffffff
mov eax, 0x5a4d
xor edi, edi
mov dword [ebp - 0x30], ebx
mov byte [ebp - 0x18], 1
mov byte [ebp - 0x17], 2
mov byte [ebp - 0x16], 3
mov byte [ebp - 0x15], 4
mov byte [ebp - 0x14], 5
mov byte [ebp - 0x13], 6
mov byte [ebp - 0x12], 7
mov byte [ebp - 0x11], 8
cmp word [ebx], ax
jne 0x4035fd
mov eax, dword [ebx + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x4035fd
cmp dword [eax + 0x7c], edi
je 0x4035fd
mov esi, dword [eax + 0x78]
add esi, ebx
mov edx, dword [esi + 0x18]
cmp edx, edi
je 0x4035fd
cmp dword [esi + 0x14], edi
je 0x4035fd
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x24]
and dword [ebp - 0x24], edi
add ecx, ebx
add eax, ebx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x20], eax
test edx, edx
jbe 0x4035fd
mov ebx, dword [ecx]
add ebx, dword [ebp - 0x30]
mov eax, ebx
lea edx, [eax + 1]
mov dword [ebp - 0x28], edx
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4034ee
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
je 0x4035bb
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x403582
jle 0x4035b5
cmp eax, 2
jg 0x4035b5
test edi, edi
jne 0x403552
cmp eax, 1
jne 0x4035fd
push 0x84
call fcn.0040532f
pop ecx
mov dword [ebp - 0x34], eax
and dword [ebp - 4], edi
test eax, eax
je 0x403542
mov ecx, eax
call fcn.00404f44
jmp 0x403544
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov edi, eax
test eax, eax
je 0x4035fd
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
push dword [ebp - 0x28]
mov eax, dword [edi]
push ebx
mov ecx, edi
call dword [eax + 8]
mov eax, dword [edi]
push 8
lea ecx, [ebp - 0x18]
push ecx
mov ecx, edi
call dword [eax + 8]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [eax]
mov ecx, dword [ebp - 0x2c]
jmp 0x4035aa
mov eax, dword [ebp + 0xc]
mov dl, byte [eax]
cmp dl, byte [ebx]
jne 0x4035a3
test dl, dl
je 0x40359f
mov dl, byte [eax + 1]
cmp dl, byte [ebx + 1]
jne 0x4035a3
inc eax
inc eax
inc ebx
inc ebx
test dl, dl
jne 0x403585
xor eax, eax
jmp 0x4035a8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4035b5
mov eax, dword [ebp - 0x20]
movzx eax, word [eax]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x4035d4
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x20], 2
add ecx, 4
mov dword [ebp - 0x2c], ecx
cmp eax, dword [esi + 0x18]
jb 0x4034e1
test edi, edi
je 0x4035e0
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
mov eax, dword [ebp - 0x1c]
cmp eax, 0xffffffff
je 0x4035fd
cmp eax, dword [esi + 0x14]
ja 0x4035fd
mov ecx, dword [esi + 0x1c]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x30]
mov eax, dword [eax + ecx]
add eax, ecx
jmp 0x4035ff
xor eax, eax
call fcn.00406a69
ret
Function at 0x403acb
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00403628
and dword [ebp - 4], 0
mov ebx, eax
shl ebx, 2
add esp, 0xc
mov dword [ebp - 8], eax
test ebx, ebx
jle 0x403b3d
lea edx, [esi + ebx*4 + 8]
lea ecx, [esi + 8]
mov eax, dword [edx - 8]
mov edi, dword [ecx - 8]
add dword [ebp - 4], 4
mov dword [ecx - 8], eax
mov eax, dword [edx - 4]
mov dword [edx - 8], edi
mov edi, dword [ecx - 4]
mov dword [ecx - 4], eax
mov eax, dword [edx]
mov dword [edx - 4], edi
mov edi, dword [ecx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [edx], edi
mov edi, dword [ecx + 4]
mov dword [ecx + 4], eax
mov dword [edx + 4], edi
sub ebx, 4
add ecx, 0x10
sub edx, 0x10
cmp dword [ebp - 4], ebx
jl 0x403afc
mov eax, dword [ebp - 8]
cmp eax, 1
jle 0x403caf
lea ecx, [eax - 1]
mov dword [ebp - 4], ecx
mov ecx, 0xff
movzx ebx, byte [esi + 0x11]
mov ebx, dword [ebx*4 + str.ccccwwww]
add esi, 0x10
mov edx, dword [esi]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, ecx
mov edi, dword [edi*4 + 0x4168a0]
and ebx, ecx
xor edi, dword [ebx*4 + 0x4170a0]
movzx ebx, byte [esi + 2]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, ecx
xor edi, dword [ebx*4 + 0x416ca0]
movzx ebx, byte [esi + 5]
and edx, ecx
mov edx, dword [edx*4 + str.ccccwwww]
and edx, ecx
xor edi, dword [edx*4 + 0x4174a0]
mov edx, dword [esi + 4]
mov dword [esi], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, ecx
mov edi, dword [edi*4 + 0x4168a0]
and ebx, ecx
xor edi, dword [ebx*4 + 0x4170a0]
movzx ebx, byte [esi + 6]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, ecx
xor edi, dword [ebx*4 + 0x416ca0]
movzx ebx, byte [esi + 9]
and edx, ecx
mov edx, dword [edx*4 + str.ccccwwww]
and edx, ecx
xor edi, dword [edx*4 + 0x4174a0]
mov edx, dword [esi + 8]
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, ecx
mov edi, dword [edi*4 + 0x4168a0]
and ebx, ecx
xor edi, dword [ebx*4 + 0x4170a0]
movzx ebx, byte [esi + 0xa]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, ecx
xor edi, dword [ebx*4 + 0x416ca0]
movzx ebx, byte [esi + 0xd]
and edx, ecx
mov edx, dword [edx*4 + str.ccccwwww]
and edx, ecx
xor edi, dword [edx*4 + 0x4174a0]
mov edx, dword [esi + 0xc]
mov dword [esi + 8], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, ecx
mov edi, dword [edi*4 + 0x4168a0]
and ebx, ecx
xor edi, dword [ebx*4 + 0x4170a0]
movzx ebx, byte [esi + 0xe]
mov ebx, dword [ebx*4 + str.ccccwwww]
and edx, ecx
mov edx, dword [edx*4 + str.ccccwwww]
and ebx, ecx
xor edi, dword [ebx*4 + 0x416ca0]
and edx, ecx
xor edi, dword [edx*4 + 0x4174a0]
dec dword [ebp - 4]
mov dword [esi + 0xc], edi
jne 0x403b51
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4049a1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
mov eax, dword [edi + 0xc]
test eax, eax
je 0x404a00
push esi
push dword [ebp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push eax
call esi
test eax, eax
jne 0x4049f8
mov eax, dword [ebp + 0x10]
push dword [eax]
call fcn.0040532f
pop ecx
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4049f8
push dword [ebp + 0x10]
push eax
push 0
push 0
push dword [ebp + 8]
push dword [edi + 0xc]
call esi
test eax, eax
je 0x4049fc
push dword [ebp + 0xc]
call fcn.004052ba
pop ecx
xor eax, eax
jmp 0x4049ff
mov eax, dword [ebp + 0xc]
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x404b73
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp eax, ecx
jne 0x404b81
xor eax, eax
inc eax
ret
xor edx, edx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov word [eax + 0x1c], dx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x60], ecx
mov dword [eax + 0x64], ecx
xor eax, eax
ret
Function at 0x404bb8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x14c
push ebx
push esi
xor edx, edx
lea ecx, [eax + 0x1f]
push edi
movzx esi, byte [ecx - 1]
movzx edi, byte [ecx]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 1]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 2]
shl esi, 8
or esi, edi
mov dword [ebp + edx*4 - 0x14c], esi
inc edx
add ecx, 4
cmp edx, 0x10
jl 0x404bcc
push 0x40
lea ecx, [ebp - 0x144]
pop edx
mov esi, dword [ecx + 0x2c]
xor esi, dword [ecx + 0x18]
xor esi, dword [ecx - 8]
xor esi, dword [ecx]
add ecx, 4
dec edx
rol esi, 1
mov dword [ecx + 0x34], esi
jne 0x404c03
mov esi, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [eax + 8]
and dword [ebp + 8], 0
mov dword [ebp - 4], esi
mov esi, dword [eax + 0x10]
mov dword [ebp - 8], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], esi
mov esi, dword [ebp - 8]
mov edi, ecx
not edi
and edi, dword [ebp - 4]
mov ebx, edx
and ebx, ecx
or edi, ebx
rol esi, 5
add esi, edi
mov edi, dword [ebp + 8]
add esi, dword [ebp + edi*4 - 0x14c]
mov edi, dword [ebp - 0xc]
inc dword [ebp + 8]
lea esi, [esi + edi + 0x5a827999]
mov edi, dword [ebp - 4]
ror ecx, 2
cmp dword [ebp + 8], 0x14
mov dword [ebp - 4], edx
mov edx, ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], esi
jl 0x404c34
mov dword [ebp + 8], 0x14
mov ebx, dword [ebp - 4]
xor ebx, edx
xor ebx, ecx
rol esi, 5
add esi, ebx
mov ebx, dword [ebp + 8]
add esi, dword [ebp + ebx*4 - 0x14c]
inc dword [ebp + 8]
lea esi, [esi + edi + 0x6ed9eba1]
mov edi, dword [ebp - 4]
ror ecx, 2
cmp dword [ebp + 8], 0x28
mov dword [ebp - 4], edx
mov edx, ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 8], esi
jl 0x404c81
mov dword [ebp - 0xc], edi
mov dword [ebp + 8], 0x28
mov edi, edx
or edi, ecx
and edi, dword [ebp - 4]
mov ebx, edx
and ebx, ecx
or edi, ebx
mov ebx, dword [ebp + 8]
add edi, dword [ebp + ebx*4 - 0x14c]
rol esi, 5
add esi, dword [ebp - 0xc]
inc dword [ebp + 8]
lea esi, [edi + esi - 0x70e44324]
mov edi, dword [ebp - 4]
ror ecx, 2
push 0x3c
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edx
pop edi
cmp dword [ebp + 8], edi
mov edx, ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 8], esi
jl 0x404cc2
mov dword [ebp + 8], edi
mov edi, dword [ebp - 4]
mov ebx, dword [ebp + 8]
xor edi, edx
xor edi, ecx
add edi, dword [ebp + ebx*4 - 0x14c]
mov ebx, dword [ebp - 4]
rol esi, 5
add esi, dword [ebp - 0xc]
inc dword [ebp + 8]
ror ecx, 2
cmp dword [ebp + 8], 0x50
mov dword [ebp - 4], edx
lea esi, [edi + esi - 0x359d3e2a]
mov edx, ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
jl 0x404d08
mov edi, dword [eax]
add edi, esi
mov esi, dword [eax + 4]
add esi, ecx
mov ecx, dword [eax + 8]
add ecx, edx
mov edx, dword [ebp - 4]
mov dword [eax + 8], ecx
mov ecx, dword [eax + 0xc]
add ecx, edx
mov dword [eax + 0xc], ecx
mov ecx, dword [eax + 0x10]
add ecx, ebx
mov dword [eax], edi
pop edi
mov dword [eax + 4], esi
mov dword [eax + 0x10], ecx
xor ecx, ecx
pop esi
mov word [eax + 0x1c], cx
pop ebx
leave
ret

Function at 0x40522b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b0b0]
jne 0x405235
repz ret
jmp fcn.004076e4
Function at 0x40f681
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004089f5
and dword [ebp - 4], 0
cmp dword [0x41cc80], 0
mov ebx, eax
jne 0x40f732
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40f7e3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40f7e3
push eax
call fcn.00408983
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41cc80], eax
call esi
push eax
call fcn.00408983
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41cc84], eax
call esi
push eax
call fcn.00408983
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41cc88], eax
call esi
push eax
call fcn.00408983
pop ecx
mov dword [0x41cc90], eax
test eax, eax
je 0x40f732
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00408983
pop ecx
mov dword [0x41cc8c], eax
mov eax, dword [0x41cc8c]
cmp eax, ebx
je 0x40f78a
cmp dword [0x41cc90], ebx
je 0x40f78a
push eax
call fcn.004089fe
push dword [0x41cc90]
mov esi, eax
call fcn.004089fe
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40f78a
test edi, edi
je 0x40f78a
call esi
test eax, eax
je 0x40f781
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40f781
test byte [ebp - 0xc], 1
jne 0x40f78a
or dword [ebp + 0x10], 0x200000
jmp 0x40f7c3
mov eax, dword [0x41cc84]
cmp eax, ebx
je 0x40f7c3
push eax
call fcn.004089fe
pop ecx
test eax, eax
je 0x40f7c3
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40f7c3
mov eax, dword [0x41cc88]
cmp eax, ebx
je 0x40f7c3
push eax
call fcn.004089fe
pop ecx
test eax, eax
je 0x40f7c3
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41cc80]
call fcn.004089fe
pop ecx
test eax, eax
je 0x40f7e3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40f7e5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41deb8
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 4]
push edx
push 1
push 0
push 0x89c8de
push 0x80000002
call fcn.0043fb40
test eax, eax
jne 0x41df07
xor ecx, ecx
mov dword [ebp - 0xc], ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0
push 0x89c90c
push dword [ebp - 4]
call fcn.0043fb46
mov dword [ebp - 8], eax
push dword [ebp - 4]
call fcn.0043fb3a
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4356f8
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
xor eax, eax
mov dword [ebx + 0x10], eax
lea eax, [ebx + 0x14]
xor ecx, ecx
mov edx, 0x40
call fcn.0043edee
mov dword [ebx + 0x54], 0x67452301
mov dword [ebx + 0x58], 0xefcdab89
mov dword [ebx + 0x5c], 0x98badcfe
mov dword [ebx + 0x60], 0x10325476
pop ebx
ret

Function at 0x43d930
Capabilities:
Encrypt data using rc4 prga

Disassembly:
adc al, 6
push eax
imul ebp, dword [esi + 0x74], 0x2b383233
mov dword [0x90000200], eax
nop
inc esp
fld dword [ebx]

Function at 0x43d944
Capabilities:
Encrypt data using rc4 prga

Disassembly:
adc al, 6
push eax
push ebp
imul ebp, dword [esi + 0x74], 0xa32b3438
add byte [edx], al
add byte [eax + 0x43d95890], dl
invalid

Function at 0x43d96c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
adc al, 7
push eax
push ebp
imul ebp, dword [esi + 0x74], 0x2b283233
mov dword [0x90000200], eax
sbb cl, 0x43
invalid

Function at 0x43d994
Capabilities:
Encrypt data using rc4 prga

Disassembly:
adc al, 7
push eax
push ebp
jae 0x43da02
outsd dx, dword [esi]
jb 0x43da11
xor byte [ebx], ch
mov dword [0x90000200], eax
test al, 0xd9
inc ebx
add byte [edx + ecx], dl
adc al, 0xa
push eax
jne 0x43da1b
imul esp, dword [ebx + 0x6f], 0x745f6564
inc esp
sub esp, dword [ebx - 0x6ffffe00]
nop
rcr cl, 0x43
add byte [esi + eax], dl
adc al, 6
push eax
push ebp
arpl word [eax + 0x61], bp
jb 0x43da11
sub esp, dword [ebx - 0x6ffffe00]
nop
mov esi, 1
xor eax, eax
cmp eax, dword [ebp - 4]
jge 0x43da3b
cmp edx, 0x10
jne 0x43da27
mov ebx, dword [ebp - 8]
movzx ebx, word [ebx + eax*2]
and ebx, 0xff00
shr ebx, 8
mov byte [ecx + esi], bl
inc esi
jecxz 0x43da1d
inc dword [eax]
add cl, al
jmp 0x43da2b
mov ebx, dword [ebp - 8]
movzx ebx, word [ebx + eax*2]
mov bh, 0x1c
inc ebx
and bl, 0xff
mov byte [ecx + esi], bl
inc esi
inc eax
cmp eax, dword [ebp - 4]
jl 0x43da0e
mov eax, esi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x43e0f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
adc al, 0xf
push eax
dec esp
outsd dx, dword [esi]
imul esp, dword [bp + di + 0x61], 0x6c6f566c
inc esp
jae 0x43e164
or cl, ah
inc ebx