joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445660
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x7a
xor eax, eax
lea edi, [esi + 4]
mov dword [0x6093ffc], esi
rep stosd dword es:[edi], eax
mov ecx, 0x24
lea edi, [esp + 0x10]
mov dword [esp + 0xc], 0x94
xor ebx, ebx
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
mov dword [esi + 0x1f8], ebx
push eax
mov dword [esi + 0x1fc], 1
mov dword [esi + 0x200], 1
mov dword [esi + 0x230], ebx
mov dword [esi + 0x234], 1
mov dword [esi + 0x204], ebx
mov dword [esi + 0x21c], ebx
mov dword [esi + 0x22c], ebx
mov dword [esi + 0x1f4], ebx
mov dword [esi + 0x238], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x1c], 2
jne 0x445708
cmp dword [esp + 0x10], 5
jb 0x445708
mov eax, 1
pop edi
mov dword [esi + 0x208], eax
pop esi
pop ebx
add esp, 0x94
ret
mov dword [esi + 0x208], ebx
pop edi
pop esi
pop ebx
add esp, 0x94
ret
Function at 0x45a320
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x1e0
or ecx, 0xffffffff
xor eax, eax
push ebx
push ebp
push esi
push edi
mov edi, 0x514f20
mov ebx, dword [esp + 0x1f4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, 1
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x60]
push ecx
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x45a3a1
mov edi, str.ERROR:_WSAStartup_failed.
or ecx, 0xffffffff
xor eax, eax
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.WSOCK32.dll_WSACleanup
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x1e0
ret
lea eax, [esp + 0x10]
push 0x50
push eax
call sub.WSOCK32.dll_gethostname
cmp eax, 0xffffffff
jne 0x45a3d9
call sub.WSOCK32.dll_WSAGetLastError
push eax
push str.ERROR___d_:_gethostname_failed.
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
call sub.WSOCK32.dll_WSACleanup
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x1e0
ret
lea ecx, [esp + 0x10]
push ecx
call sub.WSOCK32.dll_gethostbyname
test eax, eax
jne 0x45a41b
mov edi, str.ERROR:_gethostbyname_failed.
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xor ebp, ebp
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.WSOCK32.dll_WSACleanup
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x1e0
ret
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x523a2c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.WSOCK32.dll_WSACleanup
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x1e0
ret
Function at 0x45a460
Capabilities:
Get mac address on windows

Disassembly:
mov eax, 0x2818
call fcn.0045ec70
push esi
lea eax, [esp + 8]
push edi
lea ecx, [esp + 0x20]
push eax
push ecx
mov dword [esp + 0x14], 0x2800
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
je 0x45a4b7
mov edi, str.ERROR:_getadaptersinfo_failed.
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x2828]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x2818
ret
mov eax, dword [0x476eddc]
push ebx
push ebp
mov ebp, dword [esp + 0x282c]
lea ebx, [esp + 0x28]
xor ecx, ecx
xor edx, edx
mov cl, byte [ebx + 0x199]
mov dl, byte [ebx + 0x198]
push ecx
imul eax, eax, 0x119c
push edx
xor ecx, ecx
mov cl, byte [ebx + 0x197]
xor edx, edx
mov dl, byte [ebx + 0x196]
push ecx
push edx
xor ecx, ecx
mov cl, byte [ebx + 0x195]
xor edx, edx
mov dl, byte [ebx + 0x194]
push ecx
push edx
add eax, ebp
push str._02X__02X__02X__02X__02X__02X
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x476eddc]
lea edi, [ebx + 0x10c]
imul eax, eax, 0x119c
or ecx, 0xffffffff
add esp, 0x20
lea edx, [eax + ebp + 0x12]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebx + 0x1ac]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x476eddc]
imul ecx, ecx, 0x119c
mov dword [ecx + ebp + 0x98], 0
lea eax, [edx + 4]
lea edi, [esp + 0x18]
mov ecx, dword [eax]
mov dword [esp + 0x18], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [0x476eddc]
imul eax, eax, 0x119c
mov ecx, dword [eax + ebp + 0x98]
shl ecx, 4
add ecx, eax
xor eax, eax
lea esi, [ecx + ebp + 0x9c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x476eddc]
imul ecx, ecx, 0x119c
lea eax, [ecx + ebp + 0x98]
mov ecx, dword [ecx + ebp + 0x98]
inc ecx
mov dword [eax], ecx
mov edx, dword [edx]
test edx, edx
jne 0x45a565
mov eax, dword [0x476eddc]
inc eax
mov dword [0x476eddc], eax
mov ebx, dword [ebx]
test ebx, ebx
jne 0x45a4c9
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x2818
ret
Function at 0x45a620
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov eax, dword [0x476ede0]
sub esp, 0x870
test eax, eax
je 0x45a63b
mov eax, 1
add esp, 0x870
ret
lea eax, [esp + 4]
lea ecx, [esp + 0x6c]
push eax
push ecx
push 0x800
push 0x4867f0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x45a660
add esp, 0x870
ret
lea edx, [esp + 0x6c]
lea eax, [esp + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp]
push ecx
push 0x20006
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x45a699
xor eax, eax
add esp, 0x870
ret
push edi
lea edi, [esp + 0x70]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0xc]
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x14]
push 0x4867e8
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
pop edi
inc eax
add esp, 0x870
ret

Function at 0x45a6d0
Capabilities:
Create thread
Resume thread

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 8]
lea ecx, [esi + 4]
mov dword [esi], eax
mov eax, dword [esp + 0x10]
push ecx
push 0
push edx
push eax
push 0
push 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 8], eax
jne 0x45a70c
pop esi
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
Function at 0x45c040
Capabilities:
Delete file

Disassembly:
mov eax, 0x1020
call fcn.0045ec70
push esi
push edi
push 0x46f614
push str.logs.txt
mov esi, 1
call fcn.0045faec
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0x10], edi
je 0x45c1c2
push ebx
push ebp
push edi
lea eax, [esp + 0x34]
push 0x800
push eax
call fcn.004602fc
mov eax, dword [edi + 0xc]
add esp, 0xc
test al, 0x10
jne 0x45c1a8
test esi, esi
je 0x45c1a8
test al, 0x20
jne 0x45c188
lea ecx, [esp + 0x30]
push 0xe
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.0045eb70
lea eax, [esp + 0x4a]
push 2
lea ecx, [esp + 0x20]
push eax
push ecx
mov byte [esp + 0x46], 0
call fcn.0045eb70
lea edx, [esp + 0x28]
mov byte [esp + 0x2a], 0
push edx
call fcn.0045f57e
mov ebp, eax
lea eax, [esp + 0x5c]
push 4
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.0045eb70
lea edx, [esp + 0x38]
mov byte [esp + 0x3c], 0
push edx
call fcn.0045f57e
mov ebx, eax
lea eax, [esp + 0x70]
push 4
lea ecx, [esp + 0x40]
push eax
push ecx
call fcn.0045eb70
lea edx, [esp + 0x48]
mov byte [esp + 0x4c], 0
push edx
call fcn.0045f57e
mov edx, eax
lea edi, [esp + 0x84]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea esi, [esp + 0x86c]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x58], esi
mov esi, edi
mov edi, dword [esp + 0x58]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x86c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + ecx + 0x86b], al
lea ecx, [esp + 0x5c]
lea eax, [esp + 0x86c]
push ecx
push eax
push edx
push ebx
push ebp
push 1
call fcn.00427180
mov edi, dword [esp + 0x6c]
add esp, 0x54
mov esi, eax
jmp 0x45c18a
xor esi, esi
push edi
lea ecx, [esp + 0x34]
push 0x800
push ecx
call fcn.004602fc
mov eax, dword [edi + 0xc]
add esp, 0xc
test al, 0x10
je 0x45c091
push edi
call fcn.0045fa76
add esp, 4
test esi, esi
pop ebp
pop ebx
je 0x45c1c2
push str.logs.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, esi
pop edi
pop esi
add esp, 0x1020
ret
Function at 0x45c1d0
Capabilities:
Delete file

Disassembly:
mov eax, 0x1010
call fcn.0045ec70
mov eax, dword [0x476edd8]
push ebx
push ebp
push esi
mov esi, 1
push edi
mov edi, esi
cmp eax, esi
mov dword [esp + 0x10], edi
jl 0x45c2f8
mov ebp, 1
push ebp
push edi
lea eax, [esp + 0x828]
push str.reg__04d__03d.txt
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x830]
push 0x46f614
push ecx
call fcn.0045faec
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x45c2d4
push ebx
lea edx, [esp + 0x24]
push 0x800
push edx
call fcn.004602fc
mov eax, dword [ebx + 0xc]
add esp, 0xc
test al, 0x10
jne 0x45c2b1
test esi, esi
je 0x45c2b1
test al, 0x20
jne 0x45c295
mov edi, str.ISFROMFILE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
push 1
push edx
push ebp
push eax
call fcn.0041b1d0
add esp, 0x14
mov esi, eax
jmp 0x45c297
xor esi, esi
push ebx
lea ecx, [esp + 0x24]
push 0x800
push ecx
call fcn.004602fc
mov eax, dword [ebx + 0xc]
add esp, 0xc
test al, 0x10
je 0x45c249
push ebx
call fcn.0045fa76
add esp, 4
test esi, esi
je 0x45c350
lea edx, [esp + 0x820]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [esp + 0x10]
inc ebp
cmp ebp, 0x20
jl 0x45c1fb
test esi, esi
je 0x45c350
mov eax, dword [0x476edd8]
inc edi
cmp edi, eax
mov dword [esp + 0x10], edi
jle 0x45c1f6
test esi, esi
je 0x45c350
mov ecx, dword [esp + 0x1024]
test ecx, ecx
je 0x45c350
mov ebp, 1
cmp eax, ebp
jl 0x45c350
mov ebx, 0x6877f8
mov dword [esp + 0x10], ebx
mov edi, 1
cmp dword [ebx], 0
je 0x45c32b
push edi
push ebp
call fcn.00425ab0
add esp, 8
mov esi, eax
inc edi
add ebx, 4
cmp edi, 0x20
jl 0x45c31a
test esi, esi
je 0x45c350
mov ebx, dword [esp + 0x10]
mov eax, dword [0x476edd8]
inc ebp
add ebx, 0x32e60
cmp ebp, eax
mov dword [esp + 0x10], ebx
jle 0x45c315
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1010
ret
Function at 0x45c600
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x800
cmp eax, 4
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push ebp
push esi
push edi
ja case.default.0x45c61d
jmp dword [eax*4 + 0x45c7fc]
mov edi, 0x514f20
or ecx, 0xffffffff
xor eax, eax
mov ebp, dword [esp + 0x814]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x45c75c
mov ecx, dword [esp + 0x826]
mov edx, dword [esp + 0x822]
mov eax, dword [esp + 0x820]
mov ebp, dword [esp + 0x814]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
push str._04d_02d_02d
push ebp
call ebx
add esp, 0x14
jmp 0x45c761
mov esi, dword [esp + 0x820]
mov ecx, dword [esp + 0x822]
mov edx, dword [esp + 0x826]
and esi, 0xffff
and ecx, 0xffff
push esi
and edx, 0xffff
push ecx
push edx
call fcn.00407730
mov ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
mov ebp, dword [esp + 0x820]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
push edx
push esi
push str._04d_02d
push ebp
call ebx
add esp, 0x1c
jmp 0x45c761
mov ecx, dword [esp + 0x822]
mov edx, dword [esp + 0x820]
mov ebp, dword [esp + 0x814]
and ecx, 0xffff
and edx, 0xffff
push ecx
push edx
push str._04d_02d
push ebp
call ebx
add esp, 0x10
jmp 0x45c761
mov eax, dword [esp + 0x820]
mov ebp, dword [esp + 0x814]
and eax, 0xffff
push eax
push str._04d
push ebp
call ebx
add esp, 0xc
jmp 0x45c761
mov edi, 0x514f20
or ecx, 0xffffffff
xor eax, eax
mov ebp, dword [esp + 0x814]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0x514f20
mov eax, ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x45c78c
test cl, cl
je 0x45c788
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x45c78c
add eax, 2
add esi, 2
test cl, cl
jne 0x45c768
xor eax, eax
jmp 0x45c791
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x45c7ee
mov eax, dword [esp + 0x818]
push ebp
push eax
lea ecx, [esp + 0x18]
push 0x46e084
push ecx
call ebx
add esp, 0x10
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x45c7ee
lea eax, [esp + 0x10]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x45c7ee
mov edi, 0x514f20
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x800
ret
Function at 0x45d350
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push 0x80000080
push 4
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x45d379
xor eax, eax
pop esi
ret
push edi
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push 0
push ecx
push edi
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, edi
pop edi
sete al
pop esi
ret
Function at 0x465e3d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x48aa38
cmp edx, dword [eax]
je 0x465e5f
add eax, 8
inc ecx
cmp eax, 0x48aac8
jl 0x465e50
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x48aa38]
jne 0x465f8d
mov eax, dword [0x60b86f8]
cmp eax, 1
je 0x465f67
test eax, eax
jne 0x465e90
cmp dword [0x48a484], 1
je 0x465f67
cmp edx, 0xfc
je 0x465f8d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x465ec7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004604a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00460590
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x465f0a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00460590
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x46ba40
push edi
call fcn.0045eb70
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004604a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004604b0
lea eax, [ebp - 0xa0]
push 0x46ba20
push eax
call fcn.004604b0
push dword [esi + 0x48aa3c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004604b0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0046907e
add esp, 0x2c
pop edi
jmp 0x465f8d
lea eax, [ebp + 8]
lea esi, [esi + 0x48aa3c]
push 0
push eax
push dword [esi]
call fcn.00460590
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401523
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x22c]
push ebx
sub esp, 0x25c
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov esi, dword [ebp + 0xc]
and edi, 0x300
mov dword [esp], ebx
mov eax, edi
mov dword [esp + 4], esi
or eax, 9
mov dword [esp + 8], eax
call fcn.0040829c
sub esp, 0x10
test eax, eax
jne 0x40169b
test byte [ebp + 0x10], 2
je 0x4015cd
lea eax, [ebp - 0x228]
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x222]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x228], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
sub esp, 0x20
cmp eax, 0x103
jne 0x40163a
mov eax, dword [ebp + 0x10]
and eax, 1
mov dword [ebp - 0x23c], eax
jmp 0x4015f5
mov ecx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 8], ecx
call fcn.00401523
sub esp, 0xc
test eax, eax
jne 0x401651
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x222]
mov dword [esp + 0xc], 0x105
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea edx, [ebp - 0x222]
sub esp, 0x10
test eax, eax
jne 0x401651
cmp dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x22c]
je 0x4015db
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
push ecx
jmp 0x40169b
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov dword [esp], 3
call fcn.00409056
push edx
test eax, eax
jne 0x401683
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push edx
push edx
jmp 0x40169b
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call eax
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x100372f7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x10037306
pop dword [ebp - 0x1c]
mov eax, 0x9c1479e6
add eax, 0x73eef920
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x941b5173
sub dword [ebp - 0x2c], 0x45c90c28
mov dword [ebp - 0x28], 0xba89bf79
sub dword [ebp - 0x28], 0x88567334
mov dword [ebp - 0x24], 0x6d5ba97f
sub dword [ebp - 0x24], 0x210f6551
mov dword [ebp - 0x20], 0x52101898
sub dword [ebp - 0x20], 0x52101898
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x55b1df60
add eax, 0xba52ef80
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xcc905f29
sub dword [ebp - 0x2c], 0x581df5d3
mov dword [ebp - 0x28], 0xa01e0f71
sub dword [ebp - 0x28], 0x5eb1adfc
mov dword [ebp - 0x24], 0xcee1e901
sub dword [ebp - 0x24], 0x6b727c95
mov dword [ebp - 0x20], 0x71754453
add dword [ebp - 0x20], 0x8e8abbad
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x445a6
push 0
call eax
mov ecx, 0x6cacf0ae
add ecx, 0x93536a1e
mov edx, eax
mov ebx, 0x2c2cdbb2
sub ebx, 0x1c2727b2
add ebx, dword [ebp - 0x1c]
mov esi, 0x881ee7b1
add esi, 0x75af246e
xor dword [ebp - 4], ebx
mov edi, dword [ebx]
add dword [ebp - 8], 0x4b09f060
add edi, esi
mov dword [ebp - 8], 0x1e6be23d
mov dword [edx], edi
add dword [ebp - 0x18], 0xee68fff
add edx, 0x943abd73
add edx, 0x6bc54291
add ebx, 0xba87f836
sub ebx, 0xba87f832
loop 0x10037423
add eax, 0x8f1be88c
add eax, 0x70e57577
mov ebx, eax
add eax, 0xc6164292
sub eax, 0xc616428d
mov ecx, sym.libEGL.dll_Ordinal_0
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x407368
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040ae10
test esi, esi
jne 0x40739e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040afa8
jmp 0x4073bc
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00407248
mov edi, eax
test esi, esi
je 0x4073bc
cmp dword [ebx], 0
je 0x4073bc
dec esi
jmp 0x4073a5
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x409a58
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00409f18
mov byte [esp], al
cmp byte [esp], 0
jne 0x409be1
test edi, edi
je 0x409be1
mov byte [esp + 1], 0
test ebp, ebp
jle 0x409b21
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x409afc
cmp edi, 0xffffffff
je 0x409abd
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x409abd
mov byte [esp], 0
jmp 0x409be1
cmp dword [esi], 1
jg 0x409afc
cmp dword [esi], 0
jne 0x409aee
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x409aee
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x409be1
lea eax, [esp + 0xc]
call fcn.00409708
dec ebp
test ebp, ebp
jg 0x409aa2
cmp edi, 0xffffffff
je 0x409b21
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x409b1f
mov byte [esp], 0
jmp 0x409be1
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x409a66
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409b21
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00409c5c
mov edx, eax
mov ebx, dword [0x4d48f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x409b85
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x409b83
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x409b85
xor edi, edi
cmp byte [esp], 0
je 0x409bab
mov ebx, dword [esi]
test bl, 1
jne 0x409bc1
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409b8b
mov byte [esp + 1], 1
jmp 0x409bc1
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x409bab
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x409b38
cmp byte [esp], 0
je 0x409be1
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret