joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bd7e
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x40f004
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x418
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
push str.Mozilla_4.0__compatible__Win32__jupdate_
mov byte [ebp - 4], 4
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop ecx
lea eax, [ebp - 0x10]
mov edi, 0x20019
push eax
push edi
push ebx
push 0x4155f8
push SysReAllocString
mov dword [ebp - 0x10], ebx
call esi
cmp eax, ebx
jne 0x40be68
lea ecx, [ebp - 0x24]
call fcn.0040bd29
mov ecx, dword [ebp - 0x10]
cmp eax, ebx
mov dword [ebp - 0x24], ecx
jne 0x40be68
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push edi
push ebx
push str.MicroSoft
push ecx
call esi
cmp eax, ebx
jne 0x40be68
lea ecx, [ebp - 0x18]
call fcn.0040bd29
mov ecx, dword [ebp - 0x10]
cmp eax, ebx
mov dword [ebp - 0x18], ecx
jne 0x40be68
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push edi
push ebx
push str.Windows
push ecx
call esi
cmp eax, ebx
jne 0x40be68
lea ecx, [ebp - 0x14]
call fcn.0040bd29
mov ecx, dword [ebp - 0x10]
cmp eax, ebx
mov dword [ebp - 0x14], ecx
jne 0x40be68
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push edi
push ebx
push str.CurrentVersion
push ecx
call esi
cmp eax, ebx
jne 0x40be68
lea ecx, [ebp - 0x1c]
call fcn.0040bd29
mov ecx, dword [ebp - 0x10]
cmp eax, ebx
mov dword [ebp - 0x1c], ecx
je 0x40bea8
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.0040bd29
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.0040bd29
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0040bd29
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.0040bd29
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0040bd29
jmp 0x40bf97
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push edi
push ebx
push str.Internet_Settings
push ecx
call esi
cmp eax, ebx
jne 0x40becf
lea ecx, [ebp - 0x20]
call fcn.0040bd29
mov ecx, dword [ebp - 0x10]
cmp eax, ebx
mov dword [ebp - 0x20], ecx
je 0x40bee9
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.0040bd29
cmp dword [ebp - 0x1c], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40bf69
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.User_Agent
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40bf53
Function at 0x40c5d5
Capabilities:
Delete registry value
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push edi
lea eax, [ebp - 8]
push 1
push eax
call fcn.00408a76
pop ecx
test eax, eax
pop ecx
je 0x40c7bd
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push esi
push 4
pop ebx
lea eax, [ebp - 0x10]
push 0x415724
push eax
mov dword [ebp - 4], ebx
call edi
lea eax, [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x415728
mov dword [ebp - 4], 3
push dword [ebp - 8]
call esi
lea eax, [ebp - 4]
and byte [ebp - 0x218], 0
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x415730
mov dword [ebp - 4], 0x100
push dword [ebp - 8]
call esi
lea eax, [ebp - 0x98]
push 0x415740
push eax
call edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x80
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x415744
push dword [ebp - 8]
call esi
lea eax, [ebp - 0x118]
push 0x415758
push eax
call edi
lea eax, [ebp - 4]
xor edi, edi
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x41575c
mov dword [ebp - 4], 0x80
push dword [ebp - 8]
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x41576c
push dword [ebp - 8]
call esi
test eax, eax
jne 0x40c719
push edi
lea eax, [ebp - 0x98]
push edi
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x41577c
lea eax, [ebp - 0x218]
push 0x415780
push eax
call fcn.0040abbc
add esp, 0x20
test eax, eax
je 0x40c719
push 0x415784
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x415794
mov dword [ebp - 0x14], edi
push dword [ebp - 8]
call esi
test eax, eax
jne 0x40c7b0
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x4157a4
mov dword [ebp - 0x18], edi
push dword [ebp - 8]
call esi
push dword [ebp - 0x18]
lea eax, [ebp - 0x98]
push dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4157b8
lea eax, [ebp - 0x218]
push 0x4157bc
push eax
call fcn.0040abbc
add esp, 0x20
test eax, eax
je 0x40c7b0
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x4157c0
push dword [ebp - 8]
call esi
push 0x4157d4
push dword [ebp - 8]
call esi
push 0x4157e8
push dword [ebp - 8]
call esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
jmp 0x40c7bf
xor edi, edi
mov dword [0x415d64], edi
xor eax, eax
pop edi
leave
ret 4
Function at 0x40c7cc
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
call fcn.0040a430
test eax, eax
je 0x40c88e
push 4
xor ebx, ebx
pop eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push 1
push eax
call fcn.00408a76
pop ecx
test eax, eax
pop ecx
je 0x40c88b
push esi
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x4157f8
push dword [ebp - 4]
call edi
mov esi, eax
neg esi
sbb esi, esi
inc esi
jne 0x40c849
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x415808
push dword [ebp - 4]
call edi
mov esi, eax
neg esi
sbb esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
cmp esi, ebx
pop esi
je 0x40c88b
cmp dword [0x415d64], ebx
jne 0x40c88b
cmp dword [ebp + 8], ebx
jne 0x40c87b
push 0x415d64
push ebx
push ebx
push fcn.0040c5d5
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x40c88b
push ebx
mov dword [0x415d64], 1
call fcn.0040c5d5
push 1
pop eax
pop ebx
leave
ret
Function at 0x40cc97
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 8]
push 0x415944
push eax
mov dword [ebp - 4], 3
call esi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
lea eax, [ebp - 8]
push eax
push str.Country
push ebx
call fcn.00408cac
add esp, 0x10
lea eax, [ebp - 0x208]
mov dword [ebp - 4], 0x100
push 0x415d80
push eax
call esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x208]
push eax
push str.PostStatusUrl
push ebx
call fcn.00408cac
add esp, 0x10
lea eax, [ebp - 0x88]
push 0x415960
push eax
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x80
push eax
lea eax, [ebp - 0x88]
push eax
push str.InstalledJREVersion
push ebx
call fcn.00408cac
add esp, 0x10
lea eax, [ebp - 0x108]
push 0x415978
push eax
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x80
push eax
lea eax, [ebp - 0x108]
push eax
push str.NewJREVersion
push ebx
call fcn.00408cac
push dword [ebp + 8]
lea eax, [ebp - 0x88]
push ebx
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 8]
push eax
push 0x41598c
lea eax, [ebp - 0x208]
push 0x415990
push eax
call fcn.0040abbc
add esp, 0x30
pop esi
pop ebx
leave
ret
Function at 0x40e3b1
Capabilities:
Create process on windows

Disassembly:
cmp word [esp + 8], 0xcc
jne 0x40e3d3
xor eax, eax
push 1
push eax
add ecx, 0x41c
push eax
push ecx
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
ret 0x10
Function at 0x475f02
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
push 1
pop ebx
mov esi, ecx
mov byte [ebp - 1], bl
push dword [esi]
lea eax, [ebp - 0x14]
push 4
push ebx
push eax
call fcn.0047b221
add esp, 0x10
lea eax, [ebp - 0x14]
mov ecx, esi
push 0x16fa
push 4
push eax
call fcn.00475bf2
and byte [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push str.FILE
push eax
call fcn.0047b3e0
pop ecx
test eax, eax
pop ecx
jne 0x476033
push dword [esi]
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call fcn.0047b221
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0x29bc
lea eax, [ebp - 0x11c]
push edi
push ebx
push eax
call fcn.0047b221
add esp, 0x20
lea eax, [edi + 0xa25e]
mov ecx, esi
push eax
lea eax, [ebp - 0x11c]
push edi
push eax
call fcn.00475bf2
push dword [esi]
and byte [ebp + edi - 0x11c], 0
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call fcn.0047b221
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0x29ac
push edi
push ebx
push dword [ebp + 0xc]
call fcn.0047b221
add esp, 0x20
lea eax, [edi + 0xf25e]
mov ecx, esi
push eax
push edi
push dword [ebp + 0xc]
call fcn.00475bf2
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
and byte [edi + eax], 0
lea eax, [ebp - 0x11c]
push eax
call fcn.0047b3e0
pop ecx
test eax, eax
pop ecx
je 0x47604a
push ebx
push ebx
push dword [esi]
call fcn.0047b2c8
push dword [esi]
lea eax, [ebp - 8]
push ebx
push 4
push eax
call fcn.0047b221
xor dword [ebp - 8], 0x45aa
push ebx
push 4
push dword [esi]
call fcn.0047b2c8
push ebx
push 0x10
push dword [esi]
call fcn.0047b2c8
push ebx
push dword [ebp - 8]
push dword [esi]
call fcn.0047b2c8
add esp, 0x40
jmp 0x476037
and byte [ebp - 1], 0
cmp byte [ebp - 1], bl
je 0x475f16
push 6
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
xor eax, eax
jmp 0x476043

Function at 0x47608e
Capabilities:
Hash data using crc32b

Disassembly:
mov eax, ecx
push esi
push edi
mov edi, eax
or dword [eax + 0x400], 0xffffffff
xor esi, esi
mov edx, esi
push 8
shl edx, 0x18
pop ecx
test edx, 0x80000000
je 0x4760b7
add edx, edx
xor edx, 0x4c11db7
jmp 0x4760b9
shl edx, 1
dec ecx
jne 0x4760a5
mov dword [edi], edx
inc esi
add edi, 4
cmp esi, 0x100
jl 0x47609d
pop edi
pop esi
ret

Function at 0x476241
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 1
jne 0x476266
mov eax, dword [esi + 0xc]
push 8
add eax, dword [esi + 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0047b470
add esp, 0xc
jmp 0x476279
push dword [esi + 0x1c]
lea eax, [ebp - 8]
push 8
push 1
push eax
call fcn.0047b221
add esp, 0x10
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 3]
shl eax, 8
or eax, ecx
add dword [esi + 0xc], 8
movzx ecx, byte [ebp - 2]
shl eax, 8
or eax, ecx
and byte [ebp - 4], 0
movzx ecx, byte [ebp - 1]
shl eax, 8
or eax, ecx
mov ecx, dword [ebp + 8]
push str.JB01
mov dword [ecx], eax
lea eax, [ebp - 8]
push eax
call fcn.0047b3e0
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
pop esi
leave
ret 4
Function at 0x47add4
Capabilities:
Encode data using xor

Disassembly:
mov al, cl
movzx eax, cx
inc bh
mov bh, 0xe9
or eax, 0x24c5acc8
enter 0xffffffffffffc5ac, 0x24
mov ebx, 0xd56f92f8
mov esi, 0x4680aad4
and cl, dl
push 0x138569
push 0xbd84a3
add dh, bh
mov eax, 0x9ca91d71
call 0x47ae86
and edx, 0
imul esi, esi, 0x8e45186b
adc cl, dh
test ebx, eax
dec edi
inc esi
xchg ecx, ecx
dec edi
mov esi, esi
cmp eax, eax
mov al, 0x83
lea ebp, [0x275]
test edx, 0xbeb14928
cmp eax, edi
inc esi
xor al, bh
dec ch
xchg ebp, ebx
sbb esi, 0xd9000fcb
test dh, 0xdd
xchg cl, ah
sub ebx, 0x3d7
inc cl
sbb eax, edi
movzx ecx, bp
add edx, ebx
and esi, 0x46536f6b
sub esi, 0x3b64086e
cmp ah, bh
add edx, 0x163
mov eax, 0x8b816b3a
lea ecx, [0x2f17c215]
mov ebp, edi
mov bl, 0xac
cmp ah, 0xca
cmp bh, al
movsx ebx, dl
cmp edx, 0x6b2
jb 0x47ae08
jae 0x47ae8b
dec ah
inc esi
mov edi, esi
test ecx, esi
jne 0x47ae9c
mov ebx, edi
test ah, 0xd8
lea edx, [0x881e0391]
cmp ebp, 0x79f0
pop ebp
jmp 0x47aeae
xchg edx, eax
and ch, al
xchg ah, dl
jmp 0x47aebe
push esi
mov edi, 0x21ecc2e0
imul edi, ebx
mov ecx, eax
push 0x157ee0
mov al, cl
xchg al, dl
test esi, 0xdb5dd924
dec edi
sub ecx, edi
xor edx, 0x2ea052d1
mov cl, al
add ebp, 0x330ca
test eax, 0x8a2e0cbf
and ebx, edx
sub ebp, 0x2a9
imul eax, esi
mov esi, edi
mov dh, dl
mov esi, edx
test al, 0xe7
xchg dl, dl
imul edi, eax
sub ah, 0xf2
mov edi, 0x17ab82d4
imul eax, ebx
xchg edx, edx
imul ecx, edi
push ebp
sbb edx, esi
inc ebx
repz ret

Function at 0x47f404
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x49cdb0]
jne 0x47f40e
repz ret
jmp fcn.00487498
Function at 0x4044d6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4044f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00406d32
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x404519
test byte [esp + 8], 2
je 0x404519
call fcn.00406da5
mov dword [eax], 0xd
call fcn.00406dae
mov dword [eax], 5
jmp 0x4044f2
xor eax, eax
ret

Function at 0x40ab7d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x41d350
cmp edx, dword [eax]
je 0x40ab9f
add eax, 8
inc ecx
cmp eax, 0x41d3e0
jl 0x40ab90
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x41d350]
jne 0x40accd
mov eax, dword [0x4204e0]
cmp eax, 1
je 0x40aca7
test eax, eax
jne 0x40abd0
cmp dword [0x41c8a8], 1
je 0x40aca7
cmp edx, 0xfc
je 0x40accd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40ac07
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00407720
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00407630
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40ac4a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00407630
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x418a9c
push edi
call fcn.00404e10
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00407720
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00407730
lea eax, [ebp - 0xa0]
push 0x418a7c
push eax
call fcn.00407730
push dword [esi + 0x41d354]
lea eax, [ebp - 0xa0]
push eax
call fcn.00407730
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040d12b
add esp, 0x2c
pop edi
jmp 0x40accd
lea eax, [ebp + 8]
lea esi, [esi + 0x41d354]
push 0
push eax
push dword [esi]
call fcn.00407630
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x40fbfc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x40fc1e
cmp dword [edi + 0x3c], 0
jne 0x40fc1e
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.00415523
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.0040fc4b
pop edi
pop esi
pop ebx
ret 8
Function at 0x40ff96
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x4168c4
call fcn.00405d44
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.00415523
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x40ffd5
call fcn.00415523
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40ffe3
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40fff1
or eax, 0xffffffff
jmp 0x4100d9
mov ecx, esi
call fcn.0040ff0c
mov dword [ebp - 0x14], eax
call fcn.00410d1e
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x410028
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x410028
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.00410cd2
push dword [ebp - 0x14]
call fcn.00410820
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.0040fc99
cmp eax, edi
je 0x41009b
test byte [esi + 0x24], 0x10
je 0x410069
push 4
mov ecx, esi
pop ebx
call fcn.00412dc9
test ah, 1
je 0x410061
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.00412826
cmp dword [esi + 0x1c], edi
je 0x41009b
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00412dfd
jmp 0x41009b
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x4100af
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x4100c8
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x4100c8
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.0040ff46
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x4126d4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x412716
call fcn.00415523
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x412716
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x41270d
xor eax, eax
jmp 0x41271e
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00412724
pop edi
pop esi
pop ebx
ret 4
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x42bb3e60
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x33704256
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41f004]
jne 0x40100a
repz ret
jmp fcn.0040135f

Function at 0x40549b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00401961
and dword [ebp - 4], 0
cmp dword [0x420cd8], 0
mov ebx, eax
jne 0x40554c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4055fd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4055fd
push eax
call fcn.004018ef
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x420cd8], eax
call esi
push eax
call fcn.004018ef
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x420cdc], eax
call esi
push eax
call fcn.004018ef
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x420ce0], eax
call esi
push eax
call fcn.004018ef
pop ecx
mov dword [0x420ce8], eax
test eax, eax
je 0x40554c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004018ef
pop ecx
mov dword [0x420ce4], eax
mov eax, dword [0x420ce4]
cmp eax, ebx
je 0x4055a4
cmp dword [0x420ce8], ebx
je 0x4055a4
push eax
call fcn.0040196a
push dword [0x420ce8]
mov esi, eax
call fcn.0040196a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4055a4
test edi, edi
je 0x4055a4
call esi
test eax, eax
je 0x40559b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40559b
test byte [ebp - 0xc], 1
jne 0x4055a4
or dword [ebp + 0x10], 0x200000
jmp 0x4055dd
mov eax, dword [0x420cdc]
cmp eax, ebx
je 0x4055dd
push eax
call fcn.0040196a
pop ecx
test eax, eax
je 0x4055dd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4055dd
mov eax, dword [0x420ce0]
cmp eax, ebx
je 0x4055dd
push eax
call fcn.0040196a
pop ecx
test eax, eax
je 0x4055dd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x420cd8]
call fcn.0040196a
pop ecx
test eax, eax
je 0x4055fd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4055ff
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41b5a0
Capabilities:
Get hostname

Disassembly:
sub esp, 0x42c
mov eax, dword [0x41f004]
xor eax, esp
mov dword [esp + 0x428], eax
push ebp
mov ebp, dword [esp + 0x434]
push edi
cmp ebx, 0x182
jne 0x41b5d4
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
jmp 0x41b60e
cmp ebx, 0x19f
jne 0x41b60e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push str.comazumorelocikisacudilopofazib
push str.xocofuraferigoboyirekowuyohanemi
push str.sigesonotocukayujusipeli
push str.podixahihexewezabedonizuzanicob
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RaiseException]
xor edi, edi
test ebx, ebx
jle 0x41b684
push esi
jmp 0x41b620
lea esi, [esp + 0x10]
mov dword [esp + 0xc], 5
mov dword [esp + 0x10], 0
call fcn.0041b590
mov eax, dword [esp + 0x10]
add eax, 0x46
mov dword [esp + 0xc], eax
sub dword [esp + 0xc], 0x46
mov cl, byte [esp + 0xc]
xor byte [edi + ebp], cl
cmp ebx, 0xf
jne 0x41b67e
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
inc edi
cmp edi, ebx
jl 0x41b620
pop esi
pop edi
pop ebp
cmp ebx, 0x2d
jne 0x41b69f
mov dword [0x4f9500], 0xa62e7790
mov dword [0x4f9504], 0xffffffff
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.00401000
add esp, 0x42c
ret