joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51a290
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x51a2aa
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
push 0x5af968
push esi
mov ebp, eax
call dword [sym.imp.MSVCR110.dll_strpbrk]
add esp, 8
test eax, eax
je 0x51a2f3
test ebp, ebp
je 0x51a2e4
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x51a319
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x51a319
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x51a3ce
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x51a336
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [0x5ca750]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x51a3c4
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x51a3c4
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x51a368
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x51a380
sub ecx, edx
add ecx, ebx
sub ecx, esi
lea ecx, [ecx]
mov al, byte [esi]
mov byte [ecx + esi], al
lea esi, [esi + 1]
test al, al
jne 0x51a390
test ebp, ebp
je 0x51a3bb
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x5ca754]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x5ca754]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x51a5a0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x230
mov eax, dword [0x5cab48]
xor eax, esp
mov dword [esp + 0x22c], eax
test byte [esp + 0x234], 2
je 0x51a607
lea eax, [esp + 0x9c]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x51a5ed
mov eax, dword [esp + 0x9c]
cmp al, 2
jne 0x51a5e7
shr eax, 8
cmp al, 2
je 0x51a607
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0055423a
add esp, 0x230
ret
call fcn.00540cd0
test eax, eax
jne 0x51a6f8
push str.iphlpapi.dll
call fcn.0051a290
add esp, 4
mov dword [0x5cd574], eax
test eax, eax
je 0x51a647
push str.if_nametoindex
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [0x5cd578]
test eax, eax
cmovne ecx, eax
mov dword [0x5cd578], ecx
push esi
push 0x9c
lea eax, [esp + 8]
push 0
push eax
call sub.MSVCR110.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
mov dword [esp + 4], 0x9c
push 3
push 2
push 0
push 0
mov dword [esp + 0x18], 6
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 2
call esi
push 3
push 1
push edx
push eax
call esi
push 3
push 0x20
push edx
push eax
call esi
push 3
push 0x10
push edx
push eax
call esi
push 1
push 8
push edx
push eax
call esi
push edx
push eax
push 0x33
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
pop esi
test eax, eax
je 0x51a6ec
push 0x5cfe70
mov dword [0x5cfe6c], 1
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0055423a
add esp, 0x230
ret
mov dword [0x5cfe6c], 0
xor eax, eax
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0055423a
add esp, 0x230
ret
Function at 0x51f9c0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x51f9df
cmp dword [esi + 0x90], 0
je 0x51f9df
push 2
push 3
push esi
call fcn.0051c2b0
add esp, 0xc
push dword [esp + 0xc]
call fcn.0051f480
add esp, 4
test esi, esi
je 0x51fa03
cmp dword [esi + 0x90], 0
je 0x51fa03
push 3
push esi
call fcn.0051c2f0
add esp, 8
pop esi
ret
Function at 0x528390
Capabilities:
Create thread

Disassembly:
push 0
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push 0
push 0
call dword [sym.imp.MSVCR110.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x5283b2
cmp eax, 0xffffffff
jne 0x5283b4
xor eax, eax
ret
Function at 0x52b8a0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x5cab48]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call dword [sym.imp.MSVCR110.dll_getenv]
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x52b906
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x52b906
lea eax, [esp]
push eax
call dword [0x5ca75c]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0055423a
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.0055423a
add esp, 0x108
ret

Function at 0x52d2d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esi]
push 0
mov byte [esp + 0x16], al
push 3
lea eax, [esp + 0x18]
push eax
push dword [esi + 0x1b8]
mov byte [esp + 0x20], 0xff
mov byte [esp + 0x21], bl
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x52d31c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.00517c40
add esp, 0xc
push dword [esp + 0x18]
push ebx
push str.SENT
push dword [esi]
call fcn.0052cbe0
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x52d450
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
mov eax, dword [esp + 8]
push ebx
mov eax, dword [eax]
mov dword [esp + 4], eax
mov ebx, dword [eax + 0x15c]
jne 0x52d59b
push ebp
push edi
lea ebp, [ebx + 0x1cb0]
lea edi, [ebx + 0x1eb0]
mov dword [edi], ebp
cmp ebp, edi
jae 0x52d487
mov byte [ebp], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x52d492
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x52d49d
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebx + 0x1ca8]
push esi
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [esp + 0x1c], eax
movzx eax, word [ebx + 0x1caa]
push eax
call esi
mov ecx, dword [esp + 0x1c]
movzx edx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x52d4d0
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x52d4da
mov byte [eax], ch
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x52d4e4
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x52d4ee
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x52d4f9
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x52d504
mov byte [eax], 0xf0
inc dword [edi]
mov eax, dword [edi]
mov esi, dword [esp + 0x10]
mov dword [ebx + 0x1eb4], eax
sub eax, ebp
sub eax, 2
push eax
lea eax, [ebx + 0x1cb2]
push eax
push 0x3e
push esi
mov dword [edi], ebp
call fcn.0052ccf0
mov edi, dword [esp + 0x28]
add esp, 0x10
push 0
push 3
push ebp
push dword [edi + 0x1b8]
call dword [sym.imp.WS2_32.dll_send]
mov ebp, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x52d55a
call ebp
push eax
push str.Sending_data_failed___d_
push esi
call fcn.00517c40
add esp, 0xc
push 4
lea eax, [ebx + 0x1cb3]
push eax
push edi
call fcn.0052d340
add esp, 0xc
lea eax, [ebx + 0x1cb7]
push 0
push 2
push eax
push dword [edi + 0x1b8]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x52d598
call ebp
push eax
push str.Sending_data_failed___d_
push esi
call fcn.00517c40
add esp, 0xc
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0x535710
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x88
mov eax, dword [0x5cab48]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x9c]
lea eax, [esp + 0x10]
mov ebp, dword [edi + 0x1bc]
mov ebx, dword [edi]
push eax
lea eax, [esp + 0x18]
push eax
push ebp
or esi, 0xffffffff
mov dword [esp + 0x1c], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x535772
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push ebp
mov dword [esp + 0x1c], 0x80
call dword [sym.imp.WS2_32.dll_accept]
mov esi, eax
push ebp
push edi
call fcn.00518630
add esp, 8
cmp esi, 0xffffffff
jne 0x535796
push str.Error_accept__ing_server_connect
push ebx
call fcn.00517c40
add esp, 8
mov eax, 0x1e
jmp 0x53580b
push str.Connection_accepted_from_server_n
push ebx
call fcn.00517d30
and dword [edi + 0x2a4], 0xfffff7ff
push 1
push esi
mov dword [edi + 0x1bc], esi
call fcn.0053fae0
add esp, 0x10
mov dword [edi + 0x1cc], 1
cmp dword [ebx + 0x618], 0
je 0x535809
push 1
push ebx
call fcn.00509700
mov eax, dword [ebx + 0x618]
push 1
push esi
push dword [ebx + 0x61c]
call eax
push 0
push ebx
mov esi, eax
call fcn.00509700
add esp, 0x1c
test esi, esi
je 0x535809
push edi
call fcn.00535cb0
add esp, 4
mov eax, 0x2a
jmp 0x53580b
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0055423a
add esp, 0x88
ret

Function at 0x537ff0
Capabilities:
Check http status code

Disassembly:
mov ecx, dword [esp + 8]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
push ebx
push esi
mov eax, edx
shr eax, 0x1f
push edi
mov edi, dword [esp + 0x10]
add eax, edx
mov ebx, dword [edi]
xor esi, esi
cmp eax, 2
je 0x53802a
push str.Couldnt_set_desired_mode
push ebx
call fcn.00517c40
add esp, 8
lea eax, [esi + 0x11]
pop edi
pop esi
pop ebx
ret
cmp ecx, 0xc8
je 0x538041
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.00517d30
add esp, 0xc
mov eax, dword [esp + 0x18]
cmp eax, 0x13
jne 0x538059
push edi
call fcn.00537d50
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebx
ret
cmp eax, 0x14
jne 0x53806d
push edi
call fcn.00536b80
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebx
ret
cmp eax, 0x15
jne 0x538085
push 0xd
push 1
push edi
call fcn.00537670
add esp, 0xc
mov esi, eax
pop edi
pop esi
pop ebx
ret
cmp eax, 0x16
jne 0x538099
push 0xe
push 1
push edi
call fcn.00537670
add esp, 0xc
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x3adc5c0b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x3adc5c04
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x3adc5bf5
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
pop ebp
test al, 0x88
pop ebp
test eax, 0x58aa45c6
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov eax, 0xb945c6c8
cmpsd dword [esi], dword es:[edi]
call fcn.3adc59b0
mov dh, 0x92
jae 0x3adc5bef
lea eax, [ebp - 0x58]
push eax
invalid

Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..3ean
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x2122654c
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..7LWLf
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x27f433a6
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4e2890
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8c000]
push edi
or ebp, 0xffffffff
jmp 0x4e28b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e28b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e28a8
mov eax, 1
add ebx, ebx
jne 0x4e28cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e28dc
jne 0x4e28fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e28fb
dec eax
add ebx, ebx
jne 0x4e28e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4e28c0
add ebx, ebx
jne 0x4e28f7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4e294d
xor ecx, ecx
sub eax, 3
jb 0x4e2913
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e2982
sar eax, 1
mov ebp, eax
jmp 0x4e291e
add ebx, ebx
jne 0x4e291e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e28ec
inc ecx
add ebx, ebx
jne 0x4e292c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e28ec
add ebx, ebx
jne 0x4e2939
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e292e
jne 0x4e294a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e292e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e296c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e295e
jmp 0x4e28ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e296c
add edi, ecx
jmp 0x4e28ae
pop esi
mov edi, esi
mov ecx, 0x43e8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e298a
cmp byte [edi], 0x22
jne 0x4e298a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4e298f
lea edi, [esi + 0xdf000]
mov eax, dword [edi]
or eax, eax
je 0x4e2a07
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe71ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe72f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e29bc
mov ecx, edi
jns 0x4e29eb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe72f4]
or eax, eax
je 0x4e2a01
mov dword [ebx], eax
add ebx, 4
jmp 0x4e29d9
call dword [esi + 0xe7304]
mov ebp, dword [esi + 0xe72f8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e2a3b
sub esp, 0xffffff80
jmp 0x43c493
Function at 0x1001ea3
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push esi
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
push edi
mov edi, dword [ebp + 8]
push dword [edi + 0xc]
xor ebx, ebx
push ebx
push dword [eax + 0x18]
call esi
push dword [edi + 0x10]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
push dword [edi + 0x14]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
push dword [edi + 0x18]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
push dword [edi + 0x20]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
push dword [edi + 0x1c]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push ebx
push dword [eax + 0x18]
call esi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10025f8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp + 0x14], eax
lea eax, [ebp + 0x14]
push eax
push esi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x1002646
mov eax, dword [ebp + 0x14]
cmp eax, 1
jb 0x1002641
cmp byte [eax + esi - 1], 0
jne 0x1002641
cmp dword [ebp + 0x10], 0
jbe 0x1002641
cmp dword [ebp + 0x10], 2
ja 0x1002641
xor eax, eax
jmp 0x1002646
mov eax, 0x3f7
pop esi
pop ebp
ret 0x10

Function at 0x100277d
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1002788
sub eax, edx
push esi
sar eax, 1
lea esi, [eax + eax + 2]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
test eax, eax
jne 0x10027be
push 0xe
pop eax
jmp 0x10027cd
push esi
push dword [ebp + 0xc]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x100282b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
push edi
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
push edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call esi
cmp eax, edi
je 0x1002856
cmp eax, 0x7a
jne 0x10028bb
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [ebp - 4]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
cmp ebx, edi
jne 0x1002878
push 0xe
pop eax
jmp 0x10028ba
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov esi, eax
cmp esi, edi
je 0x10028a7
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, esi
jmp 0x10028ba
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, dword [ebp + 0x18]
cmp eax, edi
je 0x10028b8
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 0x14
Function at 0x1002a8d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp + 0x14]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp + 0x14], esi
push dword [ebp + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1002ae8
mov eax, dword [ebp + 0x14]
cmp eax, 2
jb 0x1002ae3
shr eax, 1
xor ecx, ecx
cmp cx, word [edi + eax*2 - 2]
jne 0x1002ae3
mov eax, dword [ebp + 0x10]
dec eax
je 0x1002adf
dec eax
jne 0x1002ae3
push esi
push edi
call fcn.01002996
test eax, eax
jne 0x1002ae8
xor eax, eax
jmp 0x1002ae8
mov eax, 0x3f7
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0xd1e1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00d1e140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00d1e140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00d1e140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00d1e140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xd1ebfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xd1ec50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xd3087c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xd1ec43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xd1ec52
xor eax, eax
pop esi
leave
ret 4

Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4019b5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [0x40b0cc], ebx
push esi
jne 0x406c8b
mov esi, dword [ebp + 0x14]
cmp esi, ebx
jle 0x406ca2
mov eax, dword [ebp + 0xc]
push 6
shr eax, 4
inc eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, ebx
je 0x401a32
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, ebx
je 0x401a32
and dword [ebp + 0xc], 0xf
je 0x401a0b
mov ecx, dword [ebp + 0xc]
movzx edx, word [eax]
dec ecx
lea eax, [eax + edx*2 + 2]
jne 0x401a01
movzx ebx, word [eax]
lea ecx, [esi - 1]
cmp ebx, ecx
jge 0x406ca9
lea ecx, [ebx + ebx]
lea esi, [eax + 2]
mov eax, ecx
push edi
mov edi, dword [ebp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [ebp + 0x10]
and word [eax + ebx*2], 0
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 0x10
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_LoadStringW]
jmp 0x401a3c
xor eax, eax
jmp 0x401a3c
mov ebx, ecx
jmp 0x401a19