joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eab98
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.004eab14
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4ead07
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4ead07
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4eacbc
jg 0x4eabf4
test eax, eax
je 0x4eacb2
push 1
push 0x1000
call fcn.004dbdf5
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4eac17
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4eaca9
push 0x8000
push ebx
call fcn.004d5d65
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4eac40
jg 0x4eac3b
cmp ecx, 0x1000
jb 0x4eac40
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004e5f2a
add esp, 0x10
cmp eax, 0xffffffff
je 0x4eac85
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4eac3b
jl 0x4eac6c
test ecx, ecx
jne 0x4eac2d
push dword [ebp - 0xc]
push ebx
call fcn.004d5d65
push esi
call fcn.004da5b7
add esp, 0xc
xor ebx, ebx
jmp 0x4ead15
cmp byte [edi + 0x24], 0
je 0x4eac9c
cmp dword [edi + 0x20], 5
jne 0x4eac9c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4eaca7
mov ebx, dword [edi + 0x18]
jmp 0x4eaca9
xor ebx, ebx
push esi
call fcn.004da5b7
pop ecx
jmp 0x4ead15
test ecx, ecx
jg 0x4eac7e
jl 0x4eacbc
test eax, eax
jae 0x4eac7e
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004e6e66
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4eacdc
cmp byte [edi + 0x1c], 0
je 0x4eac7e
jmp 0x4ead0d
push ebx
call fcn.004de8e0
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4eac7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4ead15
cmp byte [edi + 0x1c], 0
je 0x4ead12
mov ebx, dword [edi + 0x18]
jmp 0x4ead15
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004e6e66
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x10a15c0e
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x473a0484
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x1320e0ed
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
pushal
mov ebx, dword [esp + 0x24]
mov ecx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
add ebx, ecx
mov edi, dword [ebx + 0x20]
add edi, ecx
xor esi, esi
lea edx, [edi + esi*4]
mov edx, dword [edx]
add edx, ecx
xor eax, eax
rol eax, 7
xor al, byte [edx]
inc edx
cmp byte [edx], 0
jne 0x1320e10c
cmp eax, dword [esp + 0x28]
je 0x1320e123
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x1320e103
lea edx, [edi + esi*4]
mov edx, dword [edx]
add edx, ecx
mov dword [esp + 0x1c], edx
popal
ret 8
Function at 0x40b2d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi + 0x2c]
test al, al
je 0x75f8a79f
mov ecx, dword [esi + 0x48]
dec esi
dec eax
xor eax, eax
push ebx
jecxz 0x40b2e4
add dword [edi - 0x77], edx
inc ebp
cld
loopne 0x40b337
inc ebp
Function at 0x10008646
Capabilities:
Encode data using xor

Disassembly:
push 0
mov eax, 0x10066520
call fcn.100492e3
push dword [ebp + 0x24]
xor esi, esi
mov dword [ebp - 4], esi
call fcn.100109c2
cmp dword [ebp + 0x24], esi
pop ecx
mov ebx, eax
jle 0x1000868e
mov edi, dword [ebp + 0x28]
sub edi, ebx
xor edx, edx
mov eax, esi
div dword [ebp + 0x1c]
lea ecx, [ebp + 8]
push edx
call fcn.10007923
mov cl, byte [eax]
lea eax, [esi + ebx]
mov dl, byte [edi + eax]
xor dl, cl
inc esi
cmp esi, dword [ebp + 0x24]
mov byte [eax], dl
jl 0x1000866c
push 0
push 1
lea ecx, [ebp + 8]
call fcn.10007f15
mov eax, ebx
call fcn.100493bb
ret
Function at 0x10015fe8
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x100680dc
call fcn.100492e3
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x1001600d
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x10016059
call fcn.10011410
push eax
lea ecx, [ebp - 0x10]
call fcn.10010caf
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10010b28
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.100010b0
mov eax, esi
call fcn.100493bb
ret 8

Function at 0x1001a2dc
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x1001a315
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.100044c6
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.10004416
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x1001c143
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x1001c186
call fcn.100200b8
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1001c186
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1001c1a1
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.1001bcfa
test ebx, ebx
mov esi, eax
je 0x1001c19f
test edi, edi
je 0x1001c19f
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x1001cdf2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.100200b8
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1001ce29
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.1001ca14
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x1001ce81
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
jne 0x1001cea1
cmp dword [edi + 0x54], 0
jne 0x1001cea1
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.100200b8
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.1001ce48
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8
Function at 0x10022c94
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x10022cda
call fcn.100200b8
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x10022cda
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x10022d1d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x10022d06
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x10022d06
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x10022d1a
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1002ed1e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.100200b8
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x1002ed49
xor eax, eax
jmp 0x1002eded
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 8], eax
je 0x1002ed42
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x1002ed42
movzx eax, word [esi + 6]
push ebx
push edi
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10010997
mov edi, eax
xor eax, eax
cmp word [esi + 6], ax
pop ecx
jbe 0x1002ed9e
lea ecx, [esi + 8]
movzx edx, word [ecx]
mov dword [edi + eax*4], edx
movzx edx, word [esi + 6]
inc eax
inc ecx
inc ecx
cmp eax, edx
jl 0x1002ed8d
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.1002db7b
push edi
mov ebx, eax
call fcn.100109c7
test ebx, ebx
pop ecx
je 0x1002ede0
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
lea esi, [ecx + 7]
mov ecx, dword [ebp - 4]
push eax
lea edx, [eax + 7]
push esi
push edx
call fcn.1002e207
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.1002e2b9
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret 4
Function at 0x100492d4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1008b0cc]
jne 0x100492de
repz ret
jmp fcn.100527bc

Function at 0x1005ddb7
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10052195
xor ebx, ebx
cmp dword [0x1008f110], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x1005de8c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x1005ddf7
xor eax, eax
jmp 0x1005df50
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100782f8
push edi
call esi
cmp eax, ebx
je 0x1005ddf0
push eax
call fcn.10052132
mov dword [esp], 0x100782e8
push edi
mov dword [0x1008f110], eax
call esi
push eax
call fcn.10052132
mov dword [esp], 0x100782d4
push edi
mov dword [0x1008f114], eax
call esi
push eax
call fcn.10052132
mov dword [0x1008f118], eax
lea eax, [ebp - 8]
push eax
call fcn.1004e747
test eax, eax
pop ecx
pop ecx
je 0x1005de5a
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1004c5bf
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x1005de8c
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10052132
cmp eax, ebx
pop ecx
mov dword [0x1008f120], eax
je 0x1005de8c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10052132
pop ecx
mov dword [0x1008f11c], eax
mov eax, dword [0x1008f11c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x1005df05
cmp dword [0x1008f120], esi
je 0x1005df05
push eax
call fcn.1005219e
pop ecx
call eax
cmp eax, ebx
je 0x1005ded2
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x1008f120]
call fcn.1005219e
pop ecx
call eax
test eax, eax
je 0x1005ded2
test byte [ebp - 0x18], 1
jne 0x1005df05
lea eax, [ebp - 0xc]
push eax
call fcn.1004e77e
test eax, eax
pop ecx
je 0x1005deed
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1004c5bf
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x1005defc
or dword [ebp + 0x10], 0x200000
jmp 0x1005df36
or dword [ebp + 0x10], 0x40000
jmp 0x1005df36
mov eax, dword [0x1008f114]
cmp eax, esi
je 0x1005df36
push eax
call fcn.1005219e
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1005df36
mov eax, dword [0x1008f118]
cmp eax, esi
je 0x1005df36
push dword [ebp - 4]
push eax
call fcn.1005219e
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x1008f110]
call fcn.1005219e
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x55d490
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55d69a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x194], 5
jae 0x55d618
call fcn.004c34fc
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x180]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
imul eax, dword [eax + 0x468], 0x3e8
cdq
cmp edx, dword [esp + 4]
jne 0x55d502
cmp eax, dword [esp]
pop edx
pop eax
jae 0x55d65d
jmp 0x55d50a
pop edx
pop eax
jge 0x55d65d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x16c]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x46c]
cdq
cmp edx, dword [esp + 4]
jne 0x55d530
cmp eax, dword [esp]
pop edx
pop eax
jb 0x55d541
jmp 0x55d534
pop edx
pop eax
jl 0x55d541
mov eax, dword [ebp - 4]
call fcn.00559774
jmp 0x55d65d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa4]
cmp byte [eax + 0x1c], 0
je 0x55d5c7
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 4]
add eax, 0x198
mov dl, 1
call fcn.00511490
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea ecx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xa4]
add eax, 0x20
mov dl, 1
call fcn.00511490
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x1c]
mov ecx, 1
mov eax, 0x55d6b4
call fcn.00427014
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0
call fcn.0040c338
mov edx, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xdc]
jmp 0x55d65d
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x38]
mov eax, dword [ebp - 4]
add eax, 0x198
mov dl, 1
call fcn.00511490
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
lea edx, [ebp - 0x34]
xor ecx, ecx
mov eax, 0x55d6f8
call fcn.00427014
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov ecx, 0
call fcn.0040c338
mov edx, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xdc]
jmp 0x55d65d
call fcn.004c34fc
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x1a0]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
imul eax, dword [eax + 0x464], 0x3e8
cdq
cmp edx, dword [esp + 4]
jne 0x55d647
cmp eax, dword [esp]
pop edx
pop eax
jae 0x55d65d
jmp 0x55d64b
pop edx
pop eax
jge 0x55d65d
xor ecx, ecx
mov edx, 0x55d730
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xdc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55d6a1
lea eax, [ebp - 0x38]
call fcn.0040b834
lea eax, [ebp - 0x2c]
call fcn.0040b810
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.0040b8a8
lea eax, [ebp - 0xc]
call fcn.0040b810
lea eax, [ebp - 8]
call fcn.0040b834
pop eax
jmp eax
Function at 0x58bea8
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
test dl, dl
je 0x58beba
add esp, 0xfffffff0
call fcn.0040a028
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00409a1c
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 0x10325476
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0xc3d2e1f0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x58], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x5c], edx
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x58bf24
call fcn.0040a080
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop ebp
ret
Function at 0x58c388
Capabilities:
Encode data using xor

Disassembly:
movsx ecx, byte [eax]
mov edx, 0x4e67c6a7
test ecx, ecx
je 0x58c3b1
push esi
inc eax
push edi
mov esi, edx
shl esi, 5
mov edi, edx
add esi, ecx
movsx ecx, byte [eax]
shr edi, 2
add edi, esi
xor edx, edi
inc eax
test ecx, ecx
jne 0x58c397
pop edi
pop esi
mov eax, edx
ret

Function at 0x58c3b4
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
push edi
push ebx
push ecx
mov esi, eax
mov bl, dl
mov eax, 0x24
call fcn.0058c344
mov edi, eax
mov byte [edi], 1
mov byte [edi + 4], 0x1c
add edi, 8
mov byte [edi], 0x14
rdtsc
mov dword [edi + 4], eax
rdtsc
mov dword [edi + 8], eax
test esi, esi
jne 0x58c3e7
rdtsc
jmp 0x58c3e9
mov eax, esi
shl eax, 1
or al, bl
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0x1100001
rdtsc
mov dword [edi + 0x14], eax
xor eax, eax
mov dword [edi + 0x18], eax
xchg edi, eax
pop ecx
mov dword [ecx], eax
pop ebx
pop edi
pop esi
ret

Function at 0x58c40c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
push edi
push edx
mov esi, eax
xor eax, eax
mov ax, 0x300
call fcn.0058c344
mov edi, eax
mov byte [edi], 1
mov word [edi + 4], 0x300
add edi, 8
xor ecx, ecx
mov cl, 0x14
rdtsc
mov dword [edi], eax
add edi, 4
dec ecx
jne 0x58c42e
mov dword [edi], 0xffffffff
test esi, esi
jne 0x58c446
rdtsc
jmp 0x58c448
mov eax, esi
mov dword [edi + 4], eax
add edi, 8
xor ecx, ecx
mov cl, 0xaa
rdtsc
mov dword [edi], eax
add edi, 4
dec ecx
jne 0x58c452
xchg edi, eax
sub eax, 0x300
pop edx
mov dword [edx], eax
pop edi
pop esi
ret

Function at 0x58c468
Capabilities:
Execute anti-debugging instructions

Disassembly:
push esi
push edi
push edx
mov esi, eax
xor eax, eax
mov al, 0x18
call fcn.0058c344
mov edi, eax
mov byte [edi], 1
mov byte [edi + 4], 0xa
add edi, 8
mov word [edi], 0xffff
rdtsc
mov word [edi + 2], ax
test esi, esi
jne 0x58c495
rdtsc
jmp 0x58c497
mov eax, esi
xor eax, 0xc9710266
mov dword [edi + 4], eax
rdtsc
mov word [edi + 8], ax
xchg edi, eax
pop edx
mov dword [edx], eax
pop edi
pop esi
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x429004]
jne 0x401010
repz ret
jmp fcn.00401788

Function at 0x405655
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004030b9
and dword [ebp - 4], 0
cmp dword [0x42b430], 0
mov ebx, eax
jne 0x405706
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4057b7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4057b7
push eax
call fcn.00403047
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42b430], eax
call esi
push eax
call fcn.00403047
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42b434], eax
call esi
push eax
call fcn.00403047
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42b438], eax
call esi
push eax
call fcn.00403047
pop ecx
mov dword [0x42b440], eax
test eax, eax
je 0x405706
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403047
pop ecx
mov dword [0x42b43c], eax
mov eax, dword [0x42b43c]
cmp eax, ebx
je 0x40575e
cmp dword [0x42b440], ebx
je 0x40575e
push eax
call fcn.004030c2
push dword [0x42b440]
mov esi, eax
call fcn.004030c2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40575e
test edi, edi
je 0x40575e
call esi
test eax, eax
je 0x405755
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405755
test byte [ebp - 0xc], 1
jne 0x40575e
or dword [ebp + 0x10], 0x200000
jmp 0x405797
mov eax, dword [0x42b434]
cmp eax, ebx
je 0x405797
push eax
call fcn.004030c2
pop ecx
test eax, eax
je 0x405797
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405797
mov eax, dword [0x42b438]
cmp eax, ebx
je 0x405797
push eax
call fcn.004030c2
pop ecx
test eax, eax
je 0x405797
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42b430]
call fcn.004030c2
pop ecx
test eax, eax
je 0x4057b7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4057b9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x420aef
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push dword [0x4393a4]
push dword [0x4390c0]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
leave
ret

Function at 0x420b7e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp ebx, 0x19f
jne 0x420b93
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push edi
xor edi, edi
test ebx, ebx
jle 0x420bcf
push esi
and dword [ebp - 8], 0
lea esi, [ebp - 8]
mov dword [ebp - 4], 5
call fcn.00420b73
mov eax, dword [ebp - 8]
add eax, 0x46
mov dword [ebp - 4], eax
sub dword [ebp - 4], 0xa
sub dword [ebp - 4], 0x3c
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
add eax, edi
xor byte [eax], cl
inc edi
cmp edi, ebx
jl 0x420b9b
pop esi
pop edi
cmp ebx, 0x2d
jne 0x420be6
or dword [0x4393b4], 0xffffffff
mov dword [0x4393b0], 0xa62e7790
leave
ret