joyce8/EMBER2024-capa huggingface dataset:
Function at 0x483b58
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0
call sub.ole32.dll_CoInitialize_2
call sub.kernel32.dll_GetProcessHeap
mov dword [ebp - 0x14], eax
push 0x208
push 0
push dword [ebp - 0x14]
call sub.kernel32.dll_HeapAlloc
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x532970
push 1
push 0
push 0x532960
call sub.ole32.dll_CoCreateInstance_1
mov dword [ebp - 0x10], eax
test eax, eax
js 0x483c46
mov edx, dword [ebp - 8]
mov edx, dword [edx]
lea eax, [ebp - 0xc]
push eax
push 0x532980
push dword [ebp - 8]
call dword [edx]
mov dword [ebp - 0x10], eax
test eax, eax
js 0x483c38
mov edx, dword [ebp - 8]
mov edx, dword [edx]
push dword [ebp + 8]
push dword [ebp - 8]
call dword [edx + 0x50]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov edx, dword [edx]
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [edx + 0x44]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov edx, dword [edx]
push dword [ebp + 0x14]
push dword [ebp - 8]
call dword [edx + 0x1c]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov edx, dword [edx]
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [edx + 0x24]
mov dword [ebp - 0x10], eax
push 0x104
push dword [ebp - 4]
push 0xffffffffffffffff
push dword [ebp + 0xc]
push 0
push 0
call sub.kernel32.dll_MultiByteToWideChar_1
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
push 1
push dword [ebp - 4]
push dword [ebp - 0xc]
call dword [edx + 0x18]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
push dword [ebp - 0xc]
call dword [edx + 8]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov edx, dword [edx]
push dword [ebp - 8]
call dword [edx + 8]
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push 0
push dword [ebp - 0x14]
call sub.kernel32.dll_HeapFree
call sub.ole32.dll_CoUninitialize_1
mov eax, dword [ebp - 0x10]
leave
ret 0x10

Function at 0x4840ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x107]
xor ecx, ecx
mov edx, 0xff
call fcn.00403aec
lea eax, [ebp - 4]
push eax
push esi
push ebx
call sub.advapi32.dll_RegOpenKeyA
mov dword [ebp - 8], 0xff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x107]
push eax
push 0
push 0
push edi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x107]
mov ecx, 0xff
call fcn.00405638
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x484120
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x218], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48431b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
lea eax, [ebp - 0x20e]
xor ecx, ecx
mov edx, 0xff
call fcn.00403aec
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push esi
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4842fd
xor esi, esi
push esi
mov esi, 0x484330
lea edi, [ebp - 0x20e]
mov ecx, 0x3f
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
push esi
mov esi, 0x484330
lea edi, [ebp - 0x10f]
mov ecx, 0x3f
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
mov dword [ebp - 0x10], 0xff
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x10f]
push eax
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyA
mov ebx, eax
cmp ebx, 0x103
je 0x4842eb
test ebx, ebx
jne 0x4842e3
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x10f]
mov ecx, 0xff
call fcn.00405638
mov ecx, dword [ebp - 0x218]
lea eax, [ebp - 0x214]
mov edx, 0x484438
call fcn.004056e0
mov eax, dword [ebp - 0x214]
call fcn.00405858
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20e]
push eax
push 0
push 0
push 0x484470
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
cmp byte [ebp - 0x20d], 0x3a
jne 0x4842e2
cmp byte [ebp - 0x20c], 0x5c
jne 0x4842e2
lea eax, [ebp - 0x220]
lea edx, [ebp - 0x20e]
mov ecx, 0xff
call fcn.00405638
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.00423580
mov edi, dword [ebp - 0x21c]
lea eax, [ebp - 0x224]
mov edx, edi
call fcn.004055c0
mov edx, dword [ebp - 0x224]
lea ecx, [ebp - 1]
mov eax, dword [0x63c9c8]
call fcn.00483f54
lea eax, [ebp - 0x228]
mov edx, edi
call fcn.004055c0
mov edx, dword [ebp - 0x228]
mov eax, dword [0x63c9d8]
call fcn.0042474c
cmp byte [ebp - 1], 0
je 0x4842eb
inc esi
test ebx, ebx
je 0x484196
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484322
lea eax, [ebp - 0x228]
mov edx, 6
call fcn.004053ec
ret
Function at 0x484624
Capabilities:
Copy file
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x4847bf
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x6339ec]
cmp byte [eax], 0
jne 0x4847a4
cmp dword [ebp - 4], 0
je 0x48476f
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.004033c4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00423148
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004056e0
mov eax, dword [ebp - 8]
call fcn.00405858
mov esi, eax
push esi
call sub.kernel32.dll_DeleteFileA
push 0xffffffffffffffff
push esi
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.004033c4
mov eax, dword [ebp - 0x14]
call fcn.00405858
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x4846ee
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x4847cc
mov edx, 0x4847d0
mov eax, 0x80000002
call fcn.004238d8
mov eax, dword [ebp - 4]
call fcn.00403060
call fcn.00403024
mov eax, dword [0x6339e8]
mov edx, dword [ebp - 4]
call fcn.0040541c
jmp 0x4847a4
mov eax, esi
call fcn.00423080
test al, al
jne 0x48473b
push 0x4847e8
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.004055c0
push dword [ebp - 0x1c]
push 0x4847fc
push 0x48480c
push 0x484818
push 0x484834
push 0x484844
lea eax, [ebp - 0x18]
mov edx, 7
call fcn.0040575c
mov eax, dword [ebp - 0x18]
call fcn.00405858
jmp 0x484776
mov eax, dword [ebp - 4]
push eax
mov ecx, 0x4847cc
mov edx, 0x4847d0
mov eax, 0x80000002
call fcn.004238d8
mov eax, dword [ebp - 4]
call fcn.00403060
call fcn.00403024
mov eax, dword [0x6339e8]
mov edx, dword [ebp - 4]
call fcn.0040541c
jmp 0x4847a4
mov bl, 1
mov eax, 0x48486c
push 0x10
push 0
push eax
mov eax, dword [0x63c9c8]
mov eax, dword [eax + 0x20]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_1
test bl, bl
je 0x4847a4
push 1
push 0
push 0
push 0x484944
push 0
push 0
call sub.shell32.dll_ShellExecuteA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4847c6
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004053ec
ret
Function at 0x488b50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov esi, eax
push esi
call sub.kernel32.dll_lstrlenA_1
mov edx, eax
dec edx
test edx, edx
jl 0x488b85
inc edx
xor ecx, ecx
movzx ebx, byte [esi + ecx]
mov edi, eax
and edi, 0xff
xor ebx, edi
mov ebx, dword [ebx*4 + 0x633530]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc ecx
dec edx
jne 0x488b65
pop edi
pop esi
pop ebx
ret

Function at 0x4890bc
Capabilities:
Check os version

Disassembly:
push ebx
add esp, 0xffffff6c
xor ebx, ebx
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4890ea
mov eax, dword [esp + 4]
cmp eax, 4
je 0x4890e8
cmp eax, 5
je 0x4890e8
xor ebx, ebx
jmp 0x4890ea
mov bl, 1
mov eax, ebx
add esp, 0x94
pop ebx
ret
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6d4a65e3
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x42e060
nop
nop
nop
nop
mov eax, section..rsrc_1
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x72767e04
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push 0x5040d1
push 0x504088
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.USER32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.USER32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0xc4a70f1
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x498b27f3
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x469263
Capabilities:
Encode data using xor

Disassembly:
cmp dword [eax + esi + 0x2f5e912e], esp
sub eax, 0x16b3a290
xchg ebp, eax
sub al, 0x8c
push edx
xchg ebp, eax
mov word [edx - 0x6b], ss
sub al, 0x34
push edx
jns 0x469268
sub byte [0xadf02890], ch
dec edi
test edx, ecx
push ds
call 0xc81c4956
xor al, 0xb7
movsd dword es:[edi], dword [esi]
invalid
jae 0x46928e
jne 0x469236
sbb bh, al
les esi, [edi - 0x7ce7386b]
push ds
mov byte [0x370eb12f], al
das
mov byte [0xd6756aa3], al
nop
mov byte [0xf81c2d2f], al
clc
enter 0xffffffffffffa5b7, 0xffffffffffffffc7
sbb byte [ebx], bl
mov edx, 0xd6f530a3
dec ebx
das
sub eax, 0x73bba290
sub dword [esp + esi], ebp
push edx
jns 0x469228
stosd dword es:[edi], eax
sub eax, 0xa4bd3390
xchg ecx, eax
xor ah, ch
nop
xor edi, dword [ebp - 0x13cf6e5c]
push ebp
xchg ecx, eax
mov dword [0x2ce62e30], eax
adc eax, 0xb9fb7db1
xchg ebx, eax
jns 0x4692e0
jne 0x4692ea
sbb al, byte [eax]
and al, 0xb7
push es
wait
mov ecx, 0x75304d73
and bl, byte [edx]
call 0x641d4dd6
mov ecx, 0xad2cb532
sub bl, byte [eax - 0x18]
or byte [esi], cl
mov ah, 0xe3
xor ch, dh
salc
jg 0x46929c
add ah, dl
mov dword [0x637573f7], eax
invalid
xchg ecx, eax
mov eax, dword [edx]
push eax
xchg ecx, eax
mov dword [0x6a4d73bb], eax
xor byte [esi - 0x60], dl
out 0x30, eax
mov ecx, 0x73f7afd6
push ebp
movsb byte es:[edi], byte [esi]
xor byte [esi], ch
xchg ecx, eax
sub al, 0x74
push edx
xchg ebp, eax
jne 0x4692ea
adc al, 0x63
xor al, 0xb7
xchg ebp, eax
invalid
Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, 0x7cf17320
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data_1
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7f740974
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40100e
Capabilities:
Extract resource via kernel32 functions
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc2c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax]
mov eax, dword [eax + 4]
xor esi, esi
cmp dword [0x2b6f7b4], 0xee
mov dword [ebp - 8], eax
jne 0x401052
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
mov eax, dword [0x410c78]
mov dword [ebp - 0x18], eax
mov eax, dword [0x410c7c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], 0x9e3779b9
call fcn.00401007
mov eax, dword [str.x_]
add dword [ebp - 4], 0x144
mov dword [ebp - 0x20], eax
mov eax, dword [0x410c84]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov edx, dword [0x2b6f7b4]
mov eax, edi
shl eax, 4
add eax, dword [ebp - 0x20]
cmp edx, 0xfa9
jne 0x4010bd
mov dword [0x2b6f7b0], 0xedeb2e40
cmp edx, 0x3eb
jne 0x4010cb
mov dword [0x43cefc], esi
mov ecx, dword [ebp - 4]
add ecx, edi
push ecx
mov dword [0x2b6f7ac], 0x9150ce2e
call fcn.00401000
mov ecx, dword [ebp - 0xc]
mov ebx, edi
shr ebx, cl
add ebx, dword [ebp - 0x24]
xor eax, ebx
mov dword [ebp - 0x14], eax
cmp edx, 0x27
jne 0x401123
lea eax, [ebp - 0x2c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push esi
push esi
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
lea eax, [ebp - 0xc2c]
push eax
push str.fiwezejicetizucefovedakewa
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov eax, dword [ebp - 0x14]
sub dword [ebp - 8], eax
and eax, 0x5dc052bb
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, eax
add edx, eax
shl eax, 4
add eax, dword [ebp - 0x18]
shr ecx, 5
add ecx, dword [ebp - 0x28]
push edx
mov dword [0x43cef8], esi
call fcn.00401000
xor eax, ecx
sub edi, eax
mov eax, dword [ebp - 0x1c]
sub dword [ebp - 4], eax
dec dword [ebp - 0x10]
jne 0x401092
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax], edi
pop edi
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x401519
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0x40
push 0x1000
push dword [0x2b6f7b4]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x2b6f2a4], eax
ret

Function at 0x401df2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4100d8]
jne 0x401dfc
repz ret
jmp fcn.0040480c

Function at 0x404b96
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004030fa
and dword [ebp - 4], 0
cmp dword [0x43c910], 0
mov ebx, eax
jne 0x404c47
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x404cf8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x404cf8
push eax
call fcn.00403088
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43c910], eax
call esi
push eax
call fcn.00403088
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43c914], eax
call esi
push eax
call fcn.00403088
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43c918], eax
call esi
push eax
call fcn.00403088
pop ecx
mov dword [0x43c920], eax
test eax, eax
je 0x404c47
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403088
pop ecx
mov dword [0x43c91c], eax
mov eax, dword [0x43c91c]
cmp eax, ebx
je 0x404c9f
cmp dword [0x43c920], ebx
je 0x404c9f
push eax
call fcn.00403103
push dword [0x43c920]
mov esi, eax
call fcn.00403103
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x404c9f
test edi, edi
je 0x404c9f
call esi
test eax, eax
je 0x404c96
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x404c96
test byte [ebp - 0xc], 1
jne 0x404c9f
or dword [ebp + 0x10], 0x200000
jmp 0x404cd8
mov eax, dword [0x43c914]
cmp eax, ebx
je 0x404cd8
push eax
call fcn.00403103
pop ecx
test eax, eax
je 0x404cd8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x404cd8
mov eax, dword [0x43c918]
cmp eax, ebx
je 0x404cd8
push eax
call fcn.00403103
pop ecx
test eax, eax
je 0x404cd8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43c910]
call fcn.00403103
pop ecx
test eax, eax
je 0x404cf8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x404cfa
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x575818
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp si, sp
jmp 0x579048
add dl, dl
call fcn.00570df7
mov ch, byte [eax + edx*4 - 0x696b4542]
cmp eax, 0x1ba4e391
cli
cmp byte [edx + eax + 0x56], al
pop eax
invalid

Function at 0x57780a
Capabilities:
Check for vm using instruction vpcext

Disassembly:
bswap esi
pushfd
mov esi, dword [esp + 0x38]
pushfd
mov byte [esp], ah
call fcn.00574e09
mov al, 0xf6
mov eax, 0xf8f88d3d
pop ss
mov bl, 4
arpl word [edx - 0x3e503920], si
in eax, 0xff
aaa
xor eax, 0x73474771
mov dl, 0xa6
call 0x2578a7f8
invalid
Function at 0x6b6370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x6b638e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x6df074
push ecx
mov edi, eax
call fcn.006ca198
mov esi, eax
add esp, 8
test esi, esi
jne 0x6b63cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.006ca02e
push esi
call fcn.006c9fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x6b9850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x6b98ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x6e4720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x6b98ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.006ca1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x6b98ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x6e4720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x6b992a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.006cb082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x6b9957
mov word [eax], si
add eax, 2
push eax
call fcn.006cb030
add esp, 4
jmp 0x6b9959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x6b98ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x6b98b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x6b9ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret