joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100411e
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x10045e8
call fcn.01004314
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10069cc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1003f33
cmp eax, esi
jne 0x1003f26
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1003f36
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1003f0d
xor esi, esi
inc esi
mov eax, dword [0x10069c8]
cmp eax, esi
jne 0x1003f49
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1003f84
mov eax, dword [0x10069c8]
test eax, eax
jne 0x1003f7e
mov dword [0x10069c8], esi
push 0x1001168
push 0x100115c
call fcn.01003e89
pop ecx
pop ecx
test eax, eax
je 0x1003f84
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x100404e
mov dword [0x1005340], esi
mov eax, dword [0x10069c8]
cmp eax, esi
jne 0x1003fa8
push 0x1001158
push 0x1001150
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10069c8], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1003fb5
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10069d0], ebx
je 0x1003fd6
push 0x10069d0
call fcn.01004289
pop ecx
test eax, eax
je 0x1003fd6
push ebx
push 2
push ebx
call dword [0x10069d0]
push dword [0x1005328]
push dword [0x100532c]
push dword [0x1005324]
call fcn.01001fce
add esp, 0xc
mov dword [0x100533c], eax
cmp dword [0x1005330], ebx
jne 0x1004034
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1005340], ebx
jne 0x1004042
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x100533c]
call fcn.01004359
ret
call fcn.01004461
jmp 0x1003eeb
Function at 0x402090
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
push ebx
mov ebx, dword [ebp - 4]
push esi
mov esi, dword [eax + 0xc]
push edi
lea edi, [eax + 0xc]
lea esp, [esp]
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0x30]
push eax
push ecx
call fcn.00402030
add esp, 8
test al, al
je 0x4020c7
mov ebx, dword [esi + 0x18]
mov esi, dword [esi]
cmp esi, edi
jne 0x4020b0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4020e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0xc
push esi
push eax
call fcn.00402090
mov esi, eax
mov ecx, dword [esi + 0x3c]
lea eax, [ecx + esi + 0x78]
mov eax, dword [eax]
add esp, 4
test eax, eax
jne 0x402107
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + esi + 0x1c]
add ecx, esi
push ebx
mov ebx, dword [eax + esi + 0x20]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + esi + 0x24]
mov eax, dword [eax + esi + 0x14]
push edi
add ecx, esi
add ebx, esi
xor edi, edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test eax, eax
jbe 0x40214c
mov edi, edi
mov edx, dword [ebp + 0xc]
mov eax, dword [ebx + edi*4]
push edx
add eax, esi
push eax
call fcn.00401fd0
add esp, 8
test al, al
jne 0x402155
inc edi
cmp edi, dword [ebp - 4]
jb 0x402130
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + edi*2]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + edx*4]
pop edi
pop ebx
add eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402180
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x4aaa74], 0
push ebx
push esi
push edi
mov esi, ecx
jne 0x4021dd
push 0x402170
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.0048ef24
push str.NtQueryVirtualMemory
push str.ntdll.dll
call fcn.004020e0
add esp, 8
mov dword [0x4aaa70], eax
test eax, eax
jne 0x4021d6
push str.ZwQueryVirtualMemory
push str.ntdll.dll
call fcn.004020e0
add esp, 8
mov dword [0x4aaa70], eax
mov byte [0x4aaa74], 1
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push 4
lea ecx, [ebp - 4]
push ecx
push 0x1006
push 0xffff
push eax
mov dword [esi + 0x59c], eax
mov dword [ebp - 4], 0x1194
call dword [sym.imp.WS2_32.dll_setsockopt]
call fcn.0048effe
mov word [ebp - 8], ax
mov edx, dword [ebp - 8]
push edx
push esi
call fcn.0048e48e
mov bl, byte [ebp + 8]
test bl, bl
sete al
lea edi, [esi + 4]
push esi
push edi
mov byte [esi + 2], al
call fcn.0048e892
add esp, 0x10
test bl, bl
jne 0x402249
push 0
push 0
push edi
call fcn.0048ef77
add esp, 0xc
lea ebx, [esi + 0x1e0]
push edi
push ebx
call fcn.0048e9ae
mov ecx, dword [esi + 0x59c]
push ecx
push ebx
call fcn.0048eeb1
add esp, 0x10
xor eax, eax
pop edi
mov dword [esi + 0x5a0], eax
mov dword [esi + 0x5a4], eax
mov dword [esi + 0x1d0], eax
mov dword [esi + 0x1d4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x402310
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x402323
pop ebp
ret
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
pop ebp
ret

Function at 0x403570
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
push 0x1fa0
call fcn.00475846
push 0x1fa0
mov esi, eax
push 0
push esi
mov dword [ebp - 4], 0x1fa0
call fcn.00476500
mov edx, dword [ebp + 8]
mov eax, edx
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4035a3
push 0
push 0
lea ecx, [ebp - 4]
push ecx
push esi
push 1
sub eax, edi
push eax
push edx
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x403671
call dword [0x4aaa7c]
mov edi, eax
test edi, edi
je 0x403666
push 0
push 1
push edi
call dword [0x4aaa94]
add esp, 0xc
test eax, eax
jne 0x40364f
mov edx, dword [ebp - 4]
push eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], edx
call dword [0x4aaa80]
add esp, 0xc
test eax, eax
jne 0x403638
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
push edx
push eax
push esi
call fcn.00476cc0
mov ecx, dword [ebp - 8]
add esp, 0xc
push edi
mov byte [ecx + esi], 0
call dword [0x4aaa84]
add esp, 4
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov esi, str.Error_on_decryption_
call dword [0x4aaa84]
add esp, 4
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov esi, str.Error_on_authenticate_
call dword [0x4aaa84]
add esp, 4
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, str.Get_Internal_Slot_error_
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0x493343
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403680
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push esi
push 0x400
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0x401
call fcn.00475846
push 0x400
mov esi, eax
push 0
push esi
call fcn.00476500
add esp, 0x10
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x4036f1
mov ecx, dword [ebp - 8]
xor eax, eax
test ecx, ecx
jbe 0x4036e6
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + eax]
mov byte [eax + esi], dl
mov ecx, dword [ebp - 8]
inc eax
cmp eax, ecx
jb 0x4036d5
mov byte [ecx + esi], 0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x407ae0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4915cb
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x4a7464]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x218]
push ecx
xor esi, esi
push esi
push str.CurrentVersion
push 0x493628
mov ebx, 0x104
push connect
mov dword [ebp - 0x238], ebx
call edi
test eax, eax
jne 0x407c93
push esi
xor edx, edx
push 0x493344
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], esi
mov word [ebp - 0x230], dx
call fcn.00401cd0
mov eax, 0x493628
mov dword [ebp - 4], esi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x407b80
sub eax, edx
sar eax, 1
push eax
push 0x493628
lea ecx, [ebp - 0x234]
call fcn.00401ba0
push 1
push 0x493624
lea ecx, [ebp - 0x234]
call fcn.00401ba0
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
jmp 0x407bc0
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x407bc0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call fcn.00401ba0
push 5
push str.Main
lea ecx, [ebp - 0x234]
call fcn.00401ba0
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x238], ebx
mov ebx, 8
cmp dword [ebp - 0x21c], ebx
jae 0x407c13
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x218]
push edx
push esi
push str.Install_Directory
push eax
push connect
call edi
test eax, eax
jne 0x407c7a
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea esi, [eax + eax]
push 1
push esi
call fcn.00477fd5
push esi
lea ecx, [ebp - 0x218]
mov edi, eax
push ecx
push edi
call fcn.00476cc0
add esp, 0x14
cmp dword [ebp - 0x21c], ebx
jb 0x407c76
mov edx, dword [ebp - 0x230]
push edx
call fcn.00476416
add esp, 4
mov eax, edi
jmp 0x407c95
cmp dword [ebp - 0x21c], ebx
jb 0x407c95
mov eax, dword [ebp - 0x230]
push eax
call fcn.00476416
add esp, 4
jmp 0x407c95
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00476b99
mov esp, ebp
pop ebp
ret
Function at 0x4110b0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x4110dd
push esi
push edi
jmp 0x4110c0
movzx esi, byte [edx]
movzx esi, byte [esi + 0x495370]
lea edi, [eax*8]
xor esi, edi
dec ecx
xor eax, esi
inc edx
test ecx, ecx
jg 0x4110c0
pop edi
pop esi
ret

Function at 0x4177d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 8], ecx
mov eax, edi
test edi, edi
jne 0x4177ee
xor ebx, ebx
mov dword [ebp - 0xc], ebx
jmp 0x417803
cmp byte [edi], cl
je 0x4177f7
inc eax
cmp byte [eax], cl
jne 0x4177f2
sub eax, edi
and eax, 0x3fffffff
mov ebx, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], eax
test eax, eax
jg 0x417823
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
cmp esi, 2
jge 0x41782b
xor esi, 1
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41784e
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x10]
mov ecx, esi
shl ecx, 4
mov ecx, dword [ecx + edx]
push ecx
push eax
call fcn.004100a0
add esp, 8
test eax, eax
jne 0x4178b6
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
shl esi, 4
mov esi, dword [esi + eax + 0xc]
add esi, 8
cmp dword [esi + 0xc], 0
je 0x417897
xor eax, eax
mov ecx, ebx
mov edx, edi
test ebx, ebx
jle 0x417891
mov edi, edi
movzx edi, byte [edx]
movzx edi, byte [edi + 0x495370]
lea ebx, [eax*8]
xor edi, ebx
dec ecx
xor eax, edi
inc edx
test ecx, ecx
jg 0x417870
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp - 0xc]
xor edx, edx
div dword [esi]
jmp 0x417899
xor edx, edx
push edi
mov ecx, esi
call fcn.00411140
add esp, 4
test eax, eax
je 0x4178d0
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
test eax, eax
jne 0x417817
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jl 0x417820
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 8], 0
jmp 0x4178b6
Function at 0x4178e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor edx, edx
mov esi, eax
mov dword [ebp - 8], edx
mov eax, edi
test edi, edi
jne 0x417900
xor ebx, ebx
mov dword [ebp - 0xc], ebx
jmp 0x417915
cmp byte [edi], dl
je 0x417909
inc eax
cmp byte [eax], dl
jne 0x417904
sub eax, edi
and eax, 0x3fffffff
mov ebx, eax
mov dword [ebp - 0xc], eax
mov ecx, dword [esi + 0x14]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ecx
test ecx, ecx
jle 0x4179d4
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x10], ecx
jmp 0x417933
mov eax, dword [ebp - 4]
cmp eax, 2
jge 0x41793b
xor eax, 1
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
shl eax, 4
mov esi, dword [eax + edx + 0xc]
add eax, edx
test ecx, ecx
je 0x41795e
mov eax, dword [eax]
push eax
push ecx
call fcn.004100a0
add esp, 8
test eax, eax
jne 0x4179b1
cmp dword [esi + 0x24], 0
lea ecx, [esi + 0x18]
je 0x417998
xor eax, eax
mov esi, ebx
mov edx, edi
test ebx, ebx
jle 0x417992
movzx edi, byte [edx]
movzx edi, byte [edi + 0x495370]
lea ebx, [eax*8]
xor edi, ebx
dec esi
xor eax, edi
inc edx
test esi, esi
jg 0x417971
mov edi, dword [ebp + 8]
mov ebx, dword [ebp - 0xc]
xor edx, edx
div dword [ecx]
jmp 0x41799a
xor edx, edx
push edi
call fcn.00411140
add esp, 4
test eax, eax
je 0x4179cb
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
test eax, eax
jne 0x4179d6
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
jl 0x417930
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 8], 0
jmp 0x4179b1
mov eax, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
lea eax, [esi*8]
push edi
mov edi, dword [ebp + 8]
cmp eax, 0x400
jbe 0x41c231
mov esi, 0x80
cmp esi, dword [edi]
jne 0x41c23d
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4aae94]
test eax, eax
je 0x41c248
call eax
lea ecx, [esi*8]
push ecx
call fcn.0041b930
mov esi, eax
mov eax, dword [0x4aae98]
add esp, 4
mov dword [ebp - 4], esi
test eax, eax
je 0x41c268
call eax
test esi, esi
je 0x41c235
mov edx, dword [edi + 0xc]
push ebx
push edx
call fcn.0040fd50
push esi
mov dword [edi + 0xc], esi
call dword [0x4a63a8]
mov ebx, eax
shr ebx, 3
lea eax, [ebx*8]
push eax
push 0
push esi
mov dword [ebp + 0xc], ebx
mov dword [edi], ebx
call fcn.00476500
mov ecx, dword [edi + 8]
add esp, 0x14
mov dword [edi + 8], 0
test ecx, ecx
je 0x41c34d
nop
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
xor eax, eax
test edx, edx
jle 0x41c2e1
lea esp, [esp]
movzx edi, byte [esi]
movzx edi, byte [edi + 0x495370]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc esi
test edx, edx
jg 0x41c2c0
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
xor edx, edx
div ebx
mov eax, dword [ebp - 4]
lea eax, [eax + edx*8]
test eax, eax
je 0x41c329
mov esi, dword [eax]
test esi, esi
je 0x41c2ff
mov edx, dword [eax + 4]
jmp 0x41c301
xor edx, edx
inc esi
mov dword [eax], esi
mov dword [eax + 4], ecx
test edx, edx
je 0x41c329
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x41c321
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x41c342
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x41c342
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x41c338
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x41c2b0
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x428500
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [esi]
xor edx, edx
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edx
jmp 0x428520
mov al, byte [edx + 0x495cc8]
mov byte [ebp - 4], al
test edi, edi
je 0x4285ae
cmp byte [edi], 0
mov eax, edi
je 0x42853e
inc eax
cmp byte [eax], 0
jne 0x428538
mov ecx, dword [ebp + 8]
sub eax, edi
and eax, 0x3fffffff
add ecx, 0x1a4
cmp dword [ecx + 0xc], 0
mov ebx, eax
je 0x428590
xor eax, eax
mov esi, ebx
mov edx, edi
test ebx, ebx
jle 0x42857e
movzx ecx, byte [edx]
movzx ecx, byte [ecx + 0x495370]
lea edi, [eax*8]
xor ecx, edi
dec esi
xor eax, ecx
inc edx
test esi, esi
jg 0x428560
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor edx, edx
add ecx, 0x1a4
div dword [ecx]
jmp 0x428592
xor edx, edx
push edi
call fcn.00411140
add esp, 4
test eax, eax
je 0x4285a7
mov eax, dword [eax + 8]
mov edx, dword [ebp - 8]
jmp 0x4285b4
mov edx, dword [ebp - 8]
xor eax, eax
jmp 0x4285b4
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
test eax, eax
je 0x4285c3
movzx ecx, byte [ebp - 4]
lea ecx, [ecx + ecx*4]
lea eax, [eax + ecx*4 - 0x14]
cmp dword [eax + 0xc], 0
jne 0x4285e2
inc edx
cmp edx, 3
mov dword [ebp - 8], edx
jl 0x428520
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [eax]
mov dword [esi], edx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov edx, dword [eax + 8]
mov dword [esi + 8], edx
mov ecx, dword [eax + 0xc]
mov dword [esi + 0xc], ecx
pop edi
mov dword [esi + 0x10], 0
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x476b99
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a7464]
jne 0x476ba3
repz ret
jmp fcn.0047da6c

Function at 0x489716
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0047d427
and dword [ebp - 4], 0
cmp dword [0x4abc44], 0
mov ebx, eax
jne 0x4897c7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x489878
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x489878
push eax
call fcn.0047d3b5
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4abc44], eax
call esi
push eax
call fcn.0047d3b5
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4abc48], eax
call esi
push eax
call fcn.0047d3b5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4abc4c], eax
call esi
push eax
call fcn.0047d3b5
pop ecx
mov dword [0x4abc54], eax
test eax, eax
je 0x4897c7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0047d3b5
pop ecx
mov dword [0x4abc50], eax
mov eax, dword [0x4abc50]
cmp eax, ebx
je 0x48981f
cmp dword [0x4abc54], ebx
je 0x48981f
push eax
call fcn.0047d430
push dword [0x4abc54]
mov esi, eax
call fcn.0047d430
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x48981f
test edi, edi
je 0x48981f
call esi
test eax, eax
je 0x489816
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x489816
test byte [ebp - 0xc], 1
jne 0x48981f
or dword [ebp + 0x10], 0x200000
jmp 0x489858
mov eax, dword [0x4abc48]
cmp eax, ebx
je 0x489858
push eax
call fcn.0047d430
pop ecx
test eax, eax
je 0x489858
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x489858
mov eax, dword [0x4abc4c]
cmp eax, ebx
je 0x489858
push eax
call fcn.0047d430
pop ecx
test eax, eax
je 0x489858
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4abc44]
call fcn.0047d430
pop ecx
test eax, eax
je 0x489878
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x48987a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x48f062
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0xc], 0x6a09e667
mov dword [eax + 0x10], 0xbb67ae85
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0xa54ff53a
mov dword [eax + 0x1c], 0x510e527f
mov dword [eax + 0x20], 0x9b05688c
mov dword [eax + 0x24], 0x1f83d9ab
mov dword [eax + 0x28], 0x5be0cd19
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
pop ebp
ret

Function at 0x48f0ac
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0xc], 0x67452301
mov dword [eax + 0x10], 0xefcdab89
mov dword [eax + 0x14], 0x98badcfe
mov dword [eax + 0x18], 0x10325476
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
pop ebp
ret
Function at 0x48f84c
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0xc], 0x67452301
mov dword [eax + 0x10], 0xefcdab89
mov dword [eax + 0x14], 0x98badcfe
mov dword [eax + 0x18], 0x10325476
mov dword [eax + 0x1c], 0xc3d2e1f0
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
pop ebp
ret

Function at 0x49096b
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x14], 0
mov eax, dword [ebp + 8]
movzx edx, byte [eax + 1]
push ebx
movzx ebx, byte [eax]
je 0x4909cf
push esi
push edi
mov esi, 0xff
movzx ecx, byte [eax + ebx + 2]
dec dword [ebp + 0x14]
add edx, ecx
and edx, esi
mov dword [ebp + 8], edx
lea edx, [eax + edx + 2]
mov dword [ebp - 4], edx
movzx edx, byte [edx]
mov edi, dword [ebp - 4]
mov byte [eax + ebx + 2], dl
add edx, ecx
and edx, esi
mov byte [edi], cl
mov cl, byte [edx + eax + 2]
mov edx, dword [ebp + 0x10]
xor cl, byte [edx]
mov edx, dword [ebp + 0xc]
inc ebx
and ebx, esi
inc dword [ebp + 0xc]
inc dword [ebp + 0x10]
cmp dword [ebp + 0x14], 0
mov byte [edx], cl
mov edx, dword [ebp + 8]
jne 0x490987
pop edi
pop esi
mov byte [eax], bl
mov byte [eax + 1], dl
pop ebx
leave
ret