joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42211b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42215a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42215a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42215a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42215a
cmp dword [ecx + 0x74], 0xe
jbe 0x42215a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4347a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4347cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4347cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x133f16f7
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x7869383f
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x1ea7b39
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf1e96824
jmp 0x1ea7b6b
lea esp, [esp + 2]
jmp 0x1ea7b43
lea esp, [esp + 2]
push edi
jmp 0x1ea7b65
pushfd
jmp 0x1ea73bf
xchg edi, ebx
mov cl, 0xe8
pushal
pop edi
jmp 0x1ea7b77
mov ebp, dword [esp + 0x48]
xchg ch, al
bsr edi, ebx
je 0x1ea7b9b
jne 0x1ea7ba4
xchg edx, eax
adc dword [ecx + reloc.KERNEL32.dll_GetTimeZoneInformation], eax
xchg ebx, eax
or ah, byte [ebp + 0x2474ff66]
push word [esp + 0xb]
jle 0x1ea7b17
sub esp, 0x16
jmp 0x1ea7be1
sub esp, 0x16
mov eax, 0x7e68e3a8
lea esp, [esp + 2]
jmp 0x1ea7bea
mov eax, 0x7e68e3a8
lea esp, [esp + 2]
lea edi, [esp + 0x30]
jmp 0x1ea7bcb

Function at 0x1ead983
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x1c]
not al
bsf dx, dx
je 0x1ead987
mov dh, byte [esp]
setge dh
mov dh, bh
jmp 0x1eada27
mov dl, ah
jmp 0x1ead969
mov dh, byte [esp]
jmp 0x1eada9b
mov dx, word [esp]
jmp 0x1ead9f0
jmp 0x1ead9a5
call 0x1ead9bd
jmp 0x1eada10
inc al
bt dx, cx
jnp 0x1ead9d3
jp 0x1ead9d3
lea edx, [eax*4]
jmp 0x1eadaa7
setge dh
mov dh, bh
lea edx, [eax*4]
sub al, 0xa2
lea edx, [ebx + ebx]
adc edx, 0xeecf3011
jl 0x1ead9bb
mov dx, word [esp]
jmp 0x1ead9f0

Function at 0x1ecb933
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
cmp dl, 0x5a
jmp 0x1ecb94f
pushfd
pop dword [esp]
jmp 0x1ecb919
jbe 0x1e97695
ja 0x1e976ab
cmp dl, 0x61
jb 0x1e976c1
cmc
sub esp, 0x19
jmp 0x1ecb9ad
push dword [esp + 0x10]
mov word [esp + 0xb], dx
lea esp, [esp + 1]
lea esp, [esp + 0x1c]
cmp dl, 0x7a
jmp 0x1ecb988

Function at 0x1ecb9c3
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 8]
cmp dl, 0x39
jbe 0x1e97695
ja 0x1e97710
Function at 0x1ecc67f
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push eax
jmp 0x1e978bb
lea esp, [esp + 4]
mov byte [edx + 2], 0x3d
jmp 0x1ecc1e8
jmp 0x1ecc6bd
cmp edi, 0x1a
call fcn.01ecc6a7
dec esp
jecxz 0x1ecc6ff
push ss
in eax, 0x50
mov dl, 0x24
mov edx, 0xd1ea2cdd
push eax
lea esp, [esp + 4]
jb 0x1e9789d
jae 0x1ecc681
add dl, byte [esi + 0x5c9e6304]
nop
or ebx, dword [ebx + reloc.KERNEL32.dll_GetTimeZoneInformation]
cmp dword [eax], ebx
jnp 0x1ecc72c
int 0x9c
xchg word [esp], cx
jmp 0x1ecc775
add ebx, ebp
and dword [ebp + reloc.KERNEL32.dll_GetTimeZoneInformation], edi
wait
int 0x5b
retf
lea esp, [esp + 4]
lea ecx, [edi + 0x47]
jmp 0x1e978b3

Function at 0x1ecc6a7
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
call 0x1e97746
cmp edi, 0x34
jmp 0x1ecc6f7
dec esp
add eax, dword [eax]
xchg edi, eax
dec cl
aaa
invalid
cmp edi, eax
jmp 0x1ecc740
call fcn.01ecc716
add esp, edx
pop ebx
jns 0x1e978de
sbb cl, 0xd1
sal dword [ebx], 0x52
cmp eax, 0x86bfacf9
std
jmp 0x1e977c9
lea esp, [esp + 4]
jae 0x1e97887
bswap ecx
jmp 0x1ecc6e9
mov cx, di
mov ch, byte [esp]
lea ecx, [edi + 0x41]
jmp 0x1e978b3
jae 0x1e978ef
mov cx, bp
pushfd
jae 0x1e97905
xchg cl, ch
lea ecx, [edi - 4]
jmp 0x1e978b3
Function at 0x410c70
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4025e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x70
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x401f20
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
call fcn.00404fd8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
lea eax, [ebp - 0x64]
push eax
push 0x28
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.00405038
mov dword [ebp - 0x70], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x70], 0
setne dl
neg edx
movsx eax, dx
test eax, eax
je 0x410e25
mov dword [ebp - 4], 4
xor ecx, ecx
test ecx, ecx
je 0x410d46
mov dword [ebp - 4], 6
mov dword [ebp - 0x6c], 0x1c
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x3c]
push eax
push 0x1c
lea ecx, [ebp - 0x60]
push ecx
push 0
mov edx, dword [ebp - 0x64]
push edx
call fcn.00405088
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
jmp 0x410e25
mov dword [ebp - 4], 9
lea eax, [ebp - 0x44]
push eax
push 0x404ae4
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push eax
push 0
call fcn.004050e8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x6c], 0
setne dl
neg edx
mov word [ebp - 0x74], dx
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
movsx eax, word [ebp - 0x74]
test eax, eax
je 0x410e25
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x60], 1
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410dc3
mov dword [ebp - 0x8c], 0
jmp 0x410dcf
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x8c], eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x74]
imul edx, edx, 0xc
lea eax, [ebp + edx - 0x5c]
push eax
push 8
call dword [sym.imp.MSVBVM60.DLL___vbaCopyBytes]
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410e06
mov dword [ebp - 0x90], 0
jmp 0x410e12
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x74]
imul ecx, ecx, 0xc
mov dword [ebp + ecx - 0x54], 2
jmp 0x410d14
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x64]
push edx
call fcn.00404e50
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
push 0x410e4d
jmp 0x410e4c
ret

Function at 0x710c8a
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x7109ec
pop edx
push eax
pop eax
call fcn.00710ccb
inc eax
xor dword [esi], edx
add eax, edi
sub eax, 0xc923d77a
push 0xd1f60160
mov eax, dword [esp]
add esp, 4
inc esi
sub edi, edi
inc edi
mov edi, edi
cmp esi, ebx
jne fcn.00710c8a
and edi, eax
sub edi, 1
ret
Function at 0x10033d32
Capabilities:
Check os version

Disassembly:
cmp byte [section..data], 0
push esi
mov esi, ecx
jne 0x10033d5a
push 0x1003e040
mov dword [0x1003e040], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov byte [section..data], 1
cmp dword [0x1003e050], 2
jne 0x10033dc8
mov ecx, dword [0x1003e044]
cmp ecx, 6
ja 0x10033d79
jne 0x10033dc8
cmp dword [0x1003e048], 1
jbe 0x10033dc8
mov eax, dword [0x1003e0e0]
test eax, eax
jne 0x10033db5
push 0x800
push eax
push 0x10033dd0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edx, eax
test edx, edx
je 0x10033dac
push edi
mov ecx, edx
mov edi, 0x1003e0e0
xor eax, eax
lock cmpxchg dword [edi], ecx
pop edi
test eax, eax
jne 0x10033dbf
mov eax, dword [0x1003e0e0]
test eax, eax
je 0x10033dc8
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop esi
ret
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10033dac
xor eax, eax
pop esi
ret
Function at 0x1003496b
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x29c
mov eax, dword [0x1003e0f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
push edi
mov edi, ecx
mov word [ebp - 0x298], ax
lea eax, [ebp - 0x298]
mov dword [ebp - 0x210], 0x41
push edi
mov dword [ebp - 0x214], eax
call dword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_PathIsURLW]
test eax, eax
jne 0x10037d30
movzx eax, word [edi]
test ax, ax
je 0x10037d4e
cmp eax, 0x5c
je 0x100349dd
movzx eax, word [edi + 2]
test ax, ax
je 0x10037d4e
cmp eax, 0x3a
jne 0x10037d45
push 0x104
lea ecx, [ebp - 0x298]
call fcn.10034404
mov esi, eax
test esi, esi
js 0x10034a70
cmp dword [ebp - 0x214], 0
je 0x10037e04
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x29c], eax
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edx, dword [ebp - 0x29c]
lea eax, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp - 0x214]
push edi
push eax
call fcn.10034736
push 0
lea eax, [ebp - 0x29c]
push eax
mov eax, dword [ebp - 0x214]
push eax
push eax
call dword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_UrlCreateFromPathW]
mov esi, eax
cmp esi, 0x80004003
je 0x10037e13
test esi, esi
js 0x10034a70
push dword [ebp - 0x214]
push dword [ebp + 8]
push ebx
call fcn.10034aa1
mov eax, dword [ebp - 0x214]
lea ecx, [ebp - 0x298]
cmp eax, ecx
je 0x10034a87
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10027720
mov esp, ebp
pop ebp
ret 0x14
cmp ebx, edi
je 0x10037d3e
push edi
push dword [ebp + 8]
push ebx
call fcn.10034aa1
xor esi, esi
jmp 0x10034a70
cmp eax, 0x7c
je 0x100349dd
push 0x824
lea ecx, [ebp - 0x298]
call fcn.10034404
mov esi, eax
test esi, esi
js 0x10034a70
mov ecx, dword [ebp - 0x214]
mov eax, ecx
neg eax
push 2
sbb eax, eax
and eax, dword [ebp - 0x210]
mov dword [ebp - 0x29c], eax
lea eax, [ebp - 0x29c]
push eax
push ecx
push edi
call dword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_UrlApplySchemeW]
mov esi, eax
cmp esi, 1
jne 0x10034a5d
mov edx, dword [ebp - 0x214]
mov eax, edx
neg eax
push ecx
sbb eax, eax
mov ecx, edi
and eax, dword [ebp - 0x210]
push eax
call fcn.1003c7cf
mov esi, eax
test esi, esi
js 0x10037dc6
cmp esi, 1
jne 0x10034a5d
mov ecx, dword [ebp - 0x214]
mov eax, ecx
neg eax
push 1
sbb eax, eax
and eax, dword [ebp - 0x210]
mov dword [ebp - 0x29c], eax
lea eax, [ebp - 0x29c]
push eax
push ecx
push edi
call dword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_UrlApplySchemeW]
mov esi, eax
cmp esi, 1
jne 0x10034a5d
mov esi, 0x80041001
jmp 0x10034a70
mov dword [ebp - 0x29c], 0
jmp 0x10034a0c
push dword [ebp - 0x29c]
lea ecx, [ebp - 0x298]
call fcn.10034404
mov esi, eax
test esi, esi
js 0x10034a70
mov ecx, dword [ebp - 0x214]
mov eax, ecx
neg eax
push 0
sbb eax, eax
and eax, dword [ebp - 0x210]
mov dword [ebp - 0x29c], eax
lea eax, [ebp - 0x29c]
push eax
push ecx
push ecx
call dword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_UrlCreateFromPathW]
mov esi, eax
jmp 0x10034a5d
Function at 0x100364f8
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x10036536
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x1003652e
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x10036538
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x1003651e
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10036621
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x10036637
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x10036652
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x1003c2a5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1003e0f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 4
push eax
lea eax, [ebp - 0x220]
xor ebx, ebx
push eax
push ebx
push 0x18
push 0x1003c4e8
mov edi, 0x1003c480
push edi
push 0x80000002
call dword [sym.imp.KERNEL32.dll_RegGetValueW]
test eax, eax
jne 0x1003c2fa
mov ebx, dword [ebp - 0x220]
lea eax, [ebp - 0x218]
xor esi, esi
push eax
inc esi
push esi
push 0
push edi
push 0x80000002
mov dword [ebp - 0x210], esi
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x1003c382
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
push 0x10035f60
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x1003c376
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x210]
push eax
lea edx, [ebp - 0x20c]
call fcn.1003c513
mov esi, dword [ebp - 0x210]
mov edi, eax
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
test ebx, ebx
jne 0x1003c417
test edi, edi
je 0x1003c469
lea eax, [ebp - 0x218]
push eax
push 1
push ebx
push 0x1003c480
push 0x80000001
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003c461
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push 0x10035f60
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x1003c40b
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x210]
push eax
lea edx, [ebp - 0x20c]
call fcn.1003c513
mov esi, dword [ebp - 0x210]
mov edi, eax
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
test edi, edi
je 0x1003c469
test ebx, ebx
je 0x1003c461
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 4
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0x18
push 0x10035f60
push 0x10035f88
push 0x80000002
call dword [sym.imp.KERNEL32.dll_RegGetValueW]
test eax, eax
je 0x1003c459
xor esi, esi
inc esi
jmp 0x1003c469
mov esi, dword [ebp - 0x210]
jmp 0x1003c469
push ecx
call fcn.1003c629
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10027720
mov esp, ebp
pop ebp
ret 8
Function at 0x1003c740
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
test esi, esi
je 0x1003c757
mov eax, dword [esi]
mov dword [ebp - 4], eax
jmp 0x1003c75b
and dword [ebp - 4], 0
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
test esi, esi
je 0x1003c76b
lea eax, [ebp - 4]
push eax
jmp 0x1003c76d
push 0
push edi
push ebx
push 0xffff
push 0x10035f60
push 0x10035f88
push 0x80000001
call dword [sym.imp.KERNEL32.dll_RegGetValueW]
mov ecx, eax
cmp ecx, 2
je 0x1003c7a0
cmp ecx, 3
je 0x1003c7a0
test esi, esi
je 0x1003c7bf
mov eax, dword [ebp - 4]
mov dword [esi], eax
jmp 0x1003c7bf
push esi
push edi
push ebx
push 0xffff
push 0x10035f60
push 0x10035f88
push 0x80000002
call dword [sym.imp.KERNEL32.dll_RegGetValueW]
mov ecx, eax
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x46be65
Capabilities:
Packed with generic packer

Disassembly:
add ebx, 0x890cba11
mov ebx, 0
jmp 0x46be7d

Function at 0x46c0f7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
test eax, 0x80000000
je 0x46c114
mov edx, eax
and edx, 0x7fffffff
mov dword [ebp - 0xc], edx
jmp 0x46c119
xor edx, edx
mov dword [ebp - 0xc], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
and dword [ebp - 4], 0
mov eax, dword [ebx + 0x3c]
push edi
mov esi, dword [eax + ebx + 0x78]
lea eax, [eax + ebx + 0x18]
add esi, ebx
mov eax, dword [eax + 0x64]
mov edi, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x24]
add edi, ebx
add ecx, ebx
add eax, ebx
test edx, edx
mov dword [ebp - 0x10], eax
je 0x46c159
mov eax, dword [esi + 0x10]
imul eax, eax, 0x3fffffff
add eax, edx
jmp 0x46c197
and dword [ebp + 8], 0
cmp dword [esi + 0x18], 0
jbe 0x46c19f
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
push dword [ebp + 0xc]
mov eax, dword [eax]
add eax, ebx
push eax
call fcn.0046c1c5
pop ecx
test eax, eax
pop ecx
jne 0x46c18d
inc dword [ebp + 8]
add dword [ebp - 8], 4
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x18]
jb 0x46c166
jmp 0x46c19f
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
movzx eax, word [eax + ecx*2]
mov edi, dword [edi + eax*4]
add edi, ebx
mov dword [ebp - 4], edi
cmp dword [ebp + 0x10], 0
je 0x46c1bd
cmp dword [ebp - 4], esi
jbe 0x46c1bd
mov eax, dword [ebp - 0x14]
add eax, esi
cmp dword [ebp - 4], eax
jae 0x46c1bd
push dword [ebp - 0xc]
push ebx
call dword [ebp + 0x10]
jmp 0x46c1c0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x46c1ef
Capabilities:
Encode data using xor

Disassembly:
push ecx
push eax
push esi
push edi
mov ecx, edi
sub ecx, eax
mov esi, eax
mov edi, esi
lodsb al, byte [esi]
xor al, 0x4c
stosb byte es:[edi], al
loop 0x46c1fb
pop edi
pop esi
pop eax
pop ecx
ret

Function at 0x46c206
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
Function at 0x20001000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 4], 0
push esi
lea eax, [ebp - 0x2c]
mov esi, 0x20005070
push eax
push esi
mov dword [ebp - 0x2c], 0x4231327b
mov dword [ebp - 0x28], 0x44463545
mov dword [ebp - 0x24], 0x34442d46
mov dword [ebp - 0x20], 0x342d4243
mov dword [ebp - 0x1c], 0x2d303538
mov dword [ebp - 0x18], 0x39394441
mov dword [ebp - 0x14], 0x4531322d
mov dword [ebp - 0x10], 0x35423836
mov dword [ebp - 0xc], 0x33464230
mov dword [ebp - 8], 0x7d46
call sub.MSVCRT.dll_strcpy
pop ecx
mov eax, esi
pop ecx
pop esi
leave
ret

Function at 0x20001d45
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x5f444d43
push eax
mov dword [ebp - 0x10], 0x45544e45
mov dword [ebp - 0xc], 0x4d414752
mov dword [ebp - 8], 0x45
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x20001da2
push 4
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x20001d9b
push dword [ebp + 0xc]
push 0x20005398
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
and dword [0x200053f0], 0
leave
ret 8

Function at 0x20001de2
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
cmp dword [0x200053dc], 2
push edi
jne 0x20001e9d
mov edi, dword [ebp + 0xc]
cmp edi, 0x100
ja 0x20001e9d
and dword [0x200053dc], 0
and byte [ebp + 0xf], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push 1
push ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov esi, eax
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
lea eax, [ebp + 0xa]
push 0
push eax
lea eax, [ebp - 0x100]
push eax
push ebx
push esi
call dword [sym.imp.USER32.dll_ToAscii]
cmp eax, 1
jne 0x20001e52
mov al, byte [ebp + 0xa]
mov byte [ebp + 0xf], al
jmp 0x20001e8b
cmp ebx, 0x47
jb 0x20001e8b
cmp ebx, 0x49
jbe 0x20001e85
cmp ebx, 0x4a
jbe 0x20001e8b
cmp ebx, 0x4d
jbe 0x20001e80
cmp ebx, 0x4e
jbe 0x20001e8b
cmp ebx, 0x51
jbe 0x20001e7b
cmp ebx, 0x52
jne 0x20001e8b
mov byte [ebp + 0xf], 0x30
jmp 0x20001e8b
sub bl, 0x1e
jmp 0x20001e88
sub bl, 0x17
jmp 0x20001e88
sub bl, 0x10
mov byte [ebp + 0xf], bl
mov al, byte [ebp + 0xf]
pop esi
mov byte [edi + 0x20005218], al
and byte [edi + 0x20005219], 0
pop ebx
pop edi
leave
ret 8
Function at 0x20002239
Capabilities:
Contain obfuscated stackstrings
Get file size
Read .ini file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push ebx
push esi
push edi
nop
mov edi, edi
nop
mov edi, edi
mov eax, 0x76726553
mov esi, 0x20005448
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x50]
xor ebx, ebx
push eax
push 0x28
push esi
lea eax, [ebp - 0x18]
push 0x20005028
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 0x614e7265
push eax
mov dword [ebp - 0x20], 0x656d
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0x7473614c
mov dword [ebp - 0x14], 0x656d614e
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x50], 0x63655c2e
mov dword [ebp - 0x4c], 0x6f685c74
mov dword [ebp - 0x48], 0x692e656d
mov dword [ebp - 0x44], 0x696e
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], 0x694c7265
mov dword [ebp - 0x34], 0x442e7473
mov dword [ebp - 0x30], 0x7461
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
ja 0x200022e2
xor eax, eax
jmp 0x200023ce
lea eax, [ebp - 0x154]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x154]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
mov byte [eax + 1], bl
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x154]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
nop
mov edi, edi
nop
mov edi, edi
push ebx
push ebx
push 3
push ebx
push ebx
lea eax, [ebp - 0x154]
push 0x80000000
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + 1]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov dword [ebp - 8], eax
lea eax, [edi + 1]
push eax
push ebx
push dword [ebp - 8]
call sub.MSVCRT.dll_memset
add esp, 0x10
lea eax, [ebp - 4]
push ebx
push eax
push edi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push dword [ebp - 8]
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
cmp eax, ebx
pop ecx
je 0x200023c1
mov edi, dword [sym.imp.MSVCRT.dll_strchr]
push 0x2c
push eax
call edi
mov esi, eax
push 0x2c
inc esi
push esi
call edi
push 0x28
push ebx
mov ebx, 0x20005420
mov edi, eax
push ebx
call sub.MSVCRT.dll_memset
sub edi, esi
push edi
push esi
push ebx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0x28
push dword [ebp - 8]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x2000247e
Capabilities:
Create thread

Disassembly:
push edi
nop
mov edi, edi
nop
mov edi, edi
xor eax, eax
push eax
push eax
push eax
push 0x20002499
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
ret