joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40151e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x401bc0
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401bd9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401c14
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401c10
lea ebx, [ebx]
cmp esi, eax
jae 0x401c14
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401c00
cmp esi, eax
jb 0x401c1a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x402d70
Capabilities:
Get disk information

Disassembly:
jmp 0x402d70
push 0xffffffffffffffff
push 0x49dcf8
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x4cd03c]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x18]
push eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 0
jge 0x402dba
push 0x80070057
call fcn.0040141a
add eax, 0xfffffffe
cmp eax, 4
ja case.default.0x402dc6
jmp dword [eax*4 + 0x402ebc]
mov edx, dword [esp + 0x1c]
push 0xffff0002
push edx
push 0
push 0
push 0
push 3
push 3
jmp 0x402e2f
mov eax, dword [esp + 0x1c]
push 0xffff0002
push eax
push 0
push 0
push 0
push 2
push 2
jmp 0x402e2f
mov edx, dword [esp + 0x1c]
push 0xffff0002
push edx
push 0
push 0
push 0
push 2
push 2
jmp 0x402e2f
mov eax, dword [esp + 0x1c]
push 0xffff0002
push eax
jmp 0x402e25
mov edx, dword [esp + 0x1c]
push 0xffff0002
push edx
push 0
push 0
push 0
push 0
push 0
push ecx
push 0x23
mov ecx, esi
call fcn.00419cc1
push eax
mov ecx, esi
call fcn.0040128a
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x10], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402e69
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 8
lea eax, [ecx - 0x10]
mov dword [esp + 0x10], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402ea5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 8
Function at 0x40c210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x40c210
push 0xffffffffffffffff
push 0x49e898
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4cd03c]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4cd03c]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6c]
push 8
xor ebx, ebx
push str.8qnDZVc8
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], eax
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
call fcn.004011c2
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push ebx
mov al, 0x6c
push ebx
lea ecx, [esp + 0x50]
push ecx
mov dword [esp + 0x70], ebx
mov byte [esp + 0x54], 0x6b
mov byte [esp + 0x55], 0x65
mov byte [esp + 0x56], 0x72
mov byte [esp + 0x57], 0x6e
mov byte [esp + 0x58], 0x65
mov byte [esp + 0x59], al
mov byte [esp + 0x5a], 0x33
mov byte [esp + 0x5b], 0x32
mov byte [esp + 0x5c], 0x2e
mov byte [esp + 0x5d], 0x64
mov byte [esp + 0x5e], al
mov byte [esp + 0x5f], al
mov byte [esp + 0x60], bl
call ebp
mov esi, eax
push 0x16de565f
push esi
call fcn.0040140b
push 0x1a4b89aa
push esi
mov dword [esp + 0x2c], eax
call fcn.0040140b
mov edx, dword [esp + 0x44]
lea eax, [edx*8 - 0x5f27204]
push eax
push esi
call fcn.0040140b
push 0x31cb1743
push esi
mov edi, eax
call fcn.0040140b
add esp, 0x20
push 0xa
push 0x4b60
push ebx
mov dword [esp + 0x20], eax
call edi
mov esi, eax
cmp esi, ebx
jne 0x40c32b
cmp dword [esp + 0x38], 0x10
jb 0x40c324
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0040d704
add esp, 4
xor al, al
jmp 0x40c415
push esi
push ebx
call dword [esp + 0x1c]
mov dword [esp + 0x14], eax
cmp eax, ebx
jne 0x40c354
cmp dword [esp + 0x38], 0x10
jb 0x40c324
mov edx, dword [esp + 0x24]
push edx
call fcn.0040d704
add esp, 4
xor al, al
jmp 0x40c415
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov edi, eax
push ebx
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x48], 0x74
mov byte [esp + 0x49], 0x61
mov byte [esp + 0x4a], 0x73
mov byte [esp + 0x4b], 0x6b
mov byte [esp + 0x4c], 0x6d
mov byte [esp + 0x4d], 0x67
mov byte [esp + 0x4e], 0x72
mov byte [esp + 0x4f], 0x2e
mov byte [esp + 0x50], 0x65
mov byte [esp + 0x51], 0x78
mov byte [esp + 0x52], 0x65
mov byte [esp + 0x53], bl
call ebp
test eax, eax
jne 0x40c3b3
lea ecx, [esp + 0x20]
call fcn.004014b0
xor al, al
jmp 0x40c415
push ebx
push 0x4a993c
call fcn.00454dca
add esp, 4
push eax
push str.8192
call fcn.00454dca
add esp, 4
or eax, 0x1000
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [esp + 0x34]
mov esi, eax
cmp esi, ebx
je 0x40c3a6
mov ecx, dword [esp + 0x14]
push edi
push ecx
push esi
call fcn.00454e10
mov edx, dword [esp + 0x7c]
mov eax, dword [esp + 0x24]
push edi
push esi
push edx
push eax
call fcn.00401429
add esp, 0x1c
call esi
lea ecx, [esp + 0x20]
call fcn.004014b0
mov al, 1
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.004545cc
add esp, 0x54
ret
Function at 0x414d77
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x414dbe
call fcn.0041946d
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x414dbe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x414dda
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004148f1
mov esi, eax
test edi, edi
je 0x414dd8
test ebx, ebx
je 0x414dd8
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x416107
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x49f2d1
call fcn.004556cc
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x41612c
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x416172
lea ecx, [ebp - 0x10]
call fcn.00401109
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004155b5
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004013fc
mov eax, esi
call fcn.004557a4
ret 8

Function at 0x4200a8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x4200cc
cmp dword [edi + 0x54], 0
jne 0x4200cc
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0041946d
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00420069
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x421544
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x42158c
call fcn.0041946d
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x42158c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x4215cf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x4215b8
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4215b8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x4215cc
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x422418
Capabilities:
Get file attributes

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 1
mov ecx, esi
test al, 1
je 0x42243c
mov eax, dword [esi]
push 0
call dword [eax + 0x98]
test eax, eax
jne 0x42244a
pop esi
ret
mov eax, dword [esi + 0x24]
mov edx, dword [esi]
push eax
call dword [edx + 0x98]
jmp 0x422436
xor eax, eax
inc eax
pop esi
ret

Function at 0x429324
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.0041946d
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x429351
xor eax, eax
jmp 0x4293f7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x42934a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x42934a
movzx eax, word [esi + 6]
push ebx
push edi
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040d6d5
pop ecx
mov edi, eax
xor ecx, ecx
xor eax, eax
cmp cx, word [esi + 6]
jae 0x4293a8
lea ecx, [esi + 8]
movzx edx, word [ecx]
mov dword [edi + eax*4], edx
movzx edx, word [esi + 6]
inc eax
inc ecx
inc ecx
cmp eax, edx
jl 0x429397
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.00427e0f
push edi
mov ebx, eax
call fcn.0040d704
pop ecx
test ebx, ebx
je 0x4293ea
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
lea esi, [ecx + 7]
mov ecx, dword [ebp - 4]
push eax
lea edx, [eax + 7]
push esi
push edx
call fcn.00428621
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.00428744
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret 4
Function at 0x430fb3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x4a0e9c
call fcn.004556cc
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00401325
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x431015
call fcn.0041886d
cmp eax, 1
jne 0x431015
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.0041efc8
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.004013ac
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004013fc
mov dword [ebp + 8], VariantInit
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004013fc
mov eax, esi
call fcn.004557a4
ret 0x10

Function at 0x43103e
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x4a0ec7
call fcn.004556cc
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00401325
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x4310a0
call fcn.0041886d
cmp eax, 1
jne 0x4310a0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.0041efc8
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.004013ac
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004013fc
mov dword [ebp + 8], VariantInit
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004013fc
mov eax, esi
call fcn.004557a4
ret 0x14

Function at 0x4310cc
Capabilities:
Delete registry key

Disassembly:
push 0
mov eax, 0x4a0ef2
call fcn.004556cc
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00401325
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x43112e
call fcn.0041886d
cmp eax, 1
jne 0x43112e
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.0041efc8
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.004013ac
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004013fc
mov dword [ebp + 8], VariantInit
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004013fc
mov eax, esi
call fcn.004557a4
ret 8

Function at 0x4545cc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4cd03c]
jne 0x4545d6
repz ret
jmp fcn.004612cd
Function at 0x474394
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0045d61e
and dword [ebp - 4], 0
cmp dword [0x4d19f8], 0
mov ebx, eax
jne 0x474445
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4744f6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4744f6
push eax
call fcn.0045d5ac
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4d19f8], eax
call esi
push eax
call fcn.0045d5ac
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4d19fc], eax
call esi
push eax
call fcn.0045d5ac
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4d1a00], eax
call esi
push eax
call fcn.0045d5ac
pop ecx
mov dword [0x4d1a08], eax
test eax, eax
je 0x474445
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0045d5ac
pop ecx
mov dword [0x4d1a04], eax
mov eax, dword [0x4d1a04]
cmp eax, ebx
je 0x47449d
cmp dword [0x4d1a08], ebx
je 0x47449d
push eax
call fcn.0045d627
push dword [0x4d1a08]
mov esi, eax
call fcn.0045d627
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x47449d
test edi, edi
je 0x47449d
call esi
test eax, eax
je 0x474494
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x474494
test byte [ebp - 0xc], 1
jne 0x47449d
or dword [ebp + 0x10], 0x200000
jmp 0x4744d6
mov eax, dword [0x4d19fc]
cmp eax, ebx
je 0x4744d6
push eax
call fcn.0045d627
pop ecx
test eax, eax
je 0x4744d6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4744d6
mov eax, dword [0x4d1a00]
cmp eax, ebx
je 0x4744d6
push eax
call fcn.0045d627
pop ecx
test eax, eax
je 0x4744d6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4d19f8]
call fcn.0045d627
pop ecx
test eax, eax
je 0x4744f6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4744f8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4248a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa4
call fcn.004fc970
mov eax, dword [0x588eb0]
xor eax, esp
mov dword [esp + 0xa0], eax
mov ecx, dword [esp + 0xac]
mov eax, dword [esp + 0xa8]
push ebx
mov ebx, dword [esp + 0xb8]
push ebp
push esi
mov esi, dword [ecx + 4]
push edi
mov edi, dword [esp + 0xc0]
mov dword [esp + 0x18], esi
sub esi, edi
xor ebp, ebp
cmp ebx, edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebp
jae 0x42490a
push str.orig_len___md_size
push 0xf8
push str.._ssl_s3_cbc.c
call fcn.0042bff0
add esp, 0xc
cmp edi, 0x40
jbe 0x424926
push str.md_size___EVP_MAX_MD_SIZE
push 0xf9
push str.._ssl_s3_cbc.c
call fcn.0042bff0
add esp, 0xc
lea ecx, [esp + 0x30]
neg ecx
and ecx, 0x3f
lea edx, [edi + 0x100]
cmp ebx, edx
lea ecx, [esp + ecx + 0x30]
mov dword [esp + 0x1c], ecx
jbe 0x424950
mov eax, ebx
sub eax, edi
sub eax, 0x100
mov dword [esp + 0x10], eax
mov ebp, eax
mov eax, edi
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebp
add eax, esi
xor edx, edx
div edi
push edi
push 0
push ecx
mov ebx, edx
mov dword [esp + 0x30], ebx
call fcn.004ffc00
mov edx, dword [esp + 0x1c]
add esp, 0xc
xor esi, esi
cmp edx, dword [esp + 0xc4]
jae 0x424a35
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
sub edx, ecx
mov ebx, ecx
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0xbc]
mov edx, dword [edx + 0xc]
shr eax, 0x1f
shr ebx, 0x1f
sub ecx, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
jmp 0x4249c8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
add ecx, ebx
shr ecx, 0x1f
xor cl, al
mov edx, ebp
shr edx, 0x1f
xor al, dl
or cl, al
mov eax, ebx
mov bl, byte [esp + 0x2c]
shr eax, 0x1f
xor al, bl
xor bl, dl
or al, bl
xor al, dl
sub al, 1
xor cl, dl
mov edx, dword [esp + 0x14]
mov dl, byte [edx + ebp]
not al
add dword [esp + 0x10], 1
and al, dl
sub cl, 1
and al, cl
mov ecx, dword [esp + 0x1c]
or byte [esi + ecx], al
add esi, 1
mov eax, esi
sub eax, edi
xor eax, edi
mov ecx, esi
xor ecx, edi
or eax, ecx
xor eax, esi
shr eax, 0x1f
neg eax
add ebp, 1
and esi, eax
cmp ebp, dword [esp + 0xc4]
jb 0x4249c0
mov ebx, dword [esp + 0x24]
xor eax, eax
test edi, edi
jbe 0x424a75
jmp 0x424a40
mov esi, dword [esp + 0x1c]
mov edx, ebx
xor edx, 0x20
mov cl, byte [edx + esi]
mov dl, byte [ebx + esi]
mov ecx, dword [esp + 0x28]
mov byte [ecx + eax], dl
add ebx, 1
mov edx, ebx
sub edx, edi
xor edx, edi
mov ecx, ebx
xor ecx, edi
or edx, ecx
xor edx, ebx
shr edx, 0x1f
neg edx
add eax, 1
and ebx, edx
cmp eax, edi
jb 0x424a40
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004fbc95
add esp, 0xa4
ret
Function at 0x42bea0
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.004fc970
mov eax, dword [0x588eb0]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x42bf27
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x42bf27
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x100
push edx
call fcn.004ab8b0
add esp, 0x10
test eax, eax
jge 0x42befd
mov eax, 0x100
push 0
lea ecx, [esp + 8]
push ecx
push eax
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004fbc95
add esp, 0x108
ret
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0xff
push edx
call fcn.004ab8b0
add esp, 0x10
mov byte [esp + 0x107], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x42bfb9
call fcn.0042bd60
test eax, eax
jle 0x42bfb9
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x42bfcd
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 1
push 0
push 0
push 0
push 1
lea eax, [esp + 0x28]
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004fbc95
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.004fbc95
add esp, 0x108
ret

Function at 0x42c020
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x42c04a
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
sub esi, eax
mov dl, byte [esi + eax]
mov bl, byte [eax]
xor dl, bl
or cl, dl
add eax, 1
sub edi, 1
jne 0x42c037
pop esi
pop ebx
movzx eax, cl
pop edi
ret
Function at 0x437660
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x4628a0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push ebx
push eax
push ecx
call fcn.004623a0
add esp, 0xc
test eax, eax
jl 0x462aea
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
test edx, edx
push edi
jle 0x46291d
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea ebx, [ebx]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x4628e0
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x462ae6
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x55c120]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x55c120]
and esi, 0xff
mov esi, dword [esi*4 + 0x55cd20]
and edi, 0xff
xor esi, dword [edi*4 + 0x55d520]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x55c120]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x55d920]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x55c120]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x55d120]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x55c120]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x55c120]
and esi, 0xff
mov esi, dword [esi*4 + 0x55cd20]
and edi, 0xff
xor esi, dword [edi*4 + 0x55d520]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x55c120]
and edi, 0xff
xor esi, dword [edi*4 + 0x55d120]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x55c120]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x55d920]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x55c120]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x55c120]
and esi, 0xff
mov esi, dword [esi*4 + 0x55cd20]
and edi, 0xff
xor esi, dword [edi*4 + 0x55d520]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x55c120]
and edi, 0xff
xor esi, dword [edi*4 + 0x55d120]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x55c120]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x55d920]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x55c120]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x55c120]
and esi, 0xff
mov esi, dword [esi*4 + 0x55cd20]
and edi, 0xff
xor esi, dword [edi*4 + 0x55d520]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x55c120]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x55c120]
and edi, 0xff
xor esi, dword [edi*4 + 0x55d120]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x55d920]
add edx, 1
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x462931
pop edi
xor eax, eax
pop esi
pop ebx
ret