joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452064
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45220f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4521f0
mov dl, 1
mov eax, dword [0x418db0]
call fcn.004034c0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404244
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4521df
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043fb14
test al, al
je 0x4521d2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x452220
lea eax, [ebp - 0x254]
call fcn.00408fa8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4521d2
xor eax, eax
push ebp
push 0x4521cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x452258
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4521b4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004044ac
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4521b4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004044ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4521d2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4520d5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041cf0c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452216
lea eax, [ebp - 0x260]
call fcn.00404244
ret

Function at 0x452b44
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x458c54]
cmp byte [eax + 0xa5], 0
jne 0x452bb5
cmp dword [0x458c6c], 0
jne 0x452b76
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x452b00
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x458c6c], eax
cmp dword [0x458c68], 0
jne 0x452b91
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x458c68], eax
cmp dword [0x458c70], 0
jne 0x452bb5
push esp
push 0
push 0
push 0x452aa4
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x458c70], eax
pop edx
ret
Function at 0x452cac
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x452cc3
add esp, 0xfffffff0
call fcn.0040383c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00422900
mov eax, dword [0x456eb4]
cmp word [eax + 2], 0
jne 0x452ceb
mov eax, dword [0x456eb4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004542e0
mov eax, dword [0x456f44]
cmp word [eax + 2], 0
jne 0x452d05
mov eax, dword [0x456f44]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004544d8
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4188c0]
call fcn.004034c0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4188c0]
call fcn.004034c0
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x424a40]
call fcn.0042a68c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x452e8c
mov eax, dword [0x456df8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042aa5c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x454a48
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x456df8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c4cc
test eax, eax
je 0x452dfa
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408904
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c4f4
test eax, eax
je 0x452e0e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004044ac
mov eax, dword [0x456d18]
cmp byte [eax], 0
jne 0x452e42
mov eax, ebx
call fcn.00452fb4
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00454c24
mov eax, ebx
call fcn.004555d4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x452e82
call fcn.00403894
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453228
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x458c54]
cmp dword [eax + 0x30], 0
je 0x4532d2
cmp dword [ebx + 0x94], 0
jne 0x4532cc
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4531b8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4532cc
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x453292
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4532cc
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041af60
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4532a1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x453db0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x453de5
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404334
jmp 0x453df2
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404298
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x454e00
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x454e41
mov eax, esi
call fcn.0043b3dc
test al, al
je 0x454e41
mov eax, dword [ebx + 0x84]
call fcn.0043b0d8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x454e41
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043b0d8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x455848
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov ebx, eax
push 0
push 0
push 0
mov esi, ebx
and esi, 0xff
push esi
call sub.user32.dll_MapVirtualKeyA
push eax
push ebx
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push esi
call sub.user32.dll_MapVirtualKeyA
push eax
push ebx
call sub.user32.dll_keybd_event
pop esi
pop ebx
ret
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push 0xfffffffffffffff2
out dx, eax
popfd
xlatb
xchg edi, eax
sub al, 0x93
not ebx
movsd dword es:[edi], dword [esi]
pop ebx
inc edx
mov esp, 0x7bf2ea69
sub al, 0x1e
bnd jnp 0x43303f
push ds
cmp esp, dword [ebx - 0x47c439e3]
scasd eax, dword es:[edi]
jnp 0x433067
jnp 0x432fce
jnp 0x43306f
jnp 0x432fd2
jnp 0x433087
jnp 0x432fd4
cmc
jb 0x43306d
sub al, 0x1e
xor dword [esi], ebx
clc
push ds
jne 0x433070
hlt
pop ebx
sub dh, dl
out dx, eax
fincstp
cmpsd dword [esi], dword es:[edi]
sub eax, 0xa17bb21e
sbb ebx, dword [esi]
lodsb al, byte [esi]
outsb dx, byte [esi]
push ds
cmp edi, dword [esi]
int3
push ds
mov dl, 0x7b
scasd eax, dword es:[edi]
jnp 0x433077
jnp 0x433010
arpl word [esi], cx
push cs
neg byte [ecx - 0x32]
or edi, dword [esi + 0x2c]
push ds
mov dl, 0x88
mov dword [ebx + 0x767c93f7], edx
mov dl, 0x7b
sub bl, byte [esi]
jnp 0x4330ad
push ds
aas
enter 0x4d4e, 0x6e
dec esi
dec ebp
outsb dx, byte [esi]
lodsb al, byte [esi]
xor ebx, 0x7b
movsd dword es:[edi], dword [esi]
mov byte [ebx + 0x3fdda5a3], 0x3e
mov al, 0x4e
fdivr dword [ebx - 0x5f]
pop ebx
push ss
sub eax, dword [esi + 0x1e]
mov eax, dword [0x462b165b]
push ds
fdivr dword [ebx + 0x46]
sbb bl, al
jge 0x43307a
fdivr dword [ebp - 0x2d]
imul edx, dword [esi - 0x6d], 0xffffffa2
xor byte [edx + 0x125ba17b], 0x2b
jnp 0x433050
pop ebx
adc ch, byte [ebx]
shr dword [ebx + 0x16], cl
imul byte [ecx - 0x52]
loop 0x4330cb
sub eax, 0x2ce726f6
push ds
fdivr dword [ebx - 0x2d]
imul edx, dword [edx], 0x11
sub al, 0x74
mov dl, 0x11
sub byte [esp + esi*4 - 0x7c], dh
pop ecx
cli
je 0x433081
test byte [ecx - 6], bl
pop edx
or byte [eax - 0x10054de2], dh
jle 0x43309a
jnp 0x433107
loope 0x4330a4
lahf
invalid
popfd
pop esi
arpl bx, bp
pop ebx
dec esi
cmp byte [esi], bh
into
sti
cli
imul esp, edx, 0x1e2c2d7e
cmp dword [esi], edi
and byte [edi + 0x53a78bf7], dl
mov byte [0x31e661f2], al
push ds
fcomp dword [esi]
sub dword [ecx - 0xda1b45b], 0x69
neg al
jg 0x433179
imul esi, esi, 0x1e467fd8
push ds
fdivr dword [edx - 0x5f]
pop ebx
dec edx
sub esp, dword [ecx - 0x2cd4a5a5]
imul ecx, dword [edx + 0x11], 0x2c
xchg ebx, eax
test dword [edi - 0x7bb28b84], 0x6e4d1659
invalid
jmp 0x43312e
Function at 0x148d1b4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x148d1be
pushal
call 0x148d1c4
pop ebp
sub ebp, 0x10
sub ebp, 0x108d1b4
jmp 0x148d1da
mov eax, 0x108d1b4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5bc
mov edx, 0xbf24a615
xor byte [eax], dl
inc eax
dec ecx
jne 0x148d1f1
jmp 0x148d204
sahf
fcomp dword [esi + 0x1515299c]
adc eax, 0x15edd494
adc eax, 0xadd81615
adc byte [0x3daf1515], dl
adc eax, 0xf7e21515
push ss
fstp qword [esi + 0x15151994]
adc eax, 0x4545d016
jge 0x148d287
in eax, 0x34
adc eax, 0xf3f47d7d
adc eax, 0x7d313914
shr byte [edi + 0x10fd30ca], 1
adc eax, 0x3bfc1515
adc eax, 0x41401515
dec eax
sahf
nop
sbb eax, 0x9e151515
sbb byte [ecx], 0x15
adc eax, 0x5989e15
adc eax, 0xfcd41515
adc eax, 0x989e1515
add eax, 0xd4151515
cld
pop ss
and al, 0x17
xchg esi, eax
xlatb
adc dword [edx + ebx - 0x70], ebx
loope 0x148d254
ljmp 0x7198:0x31399eea
adc al, 0x39
xor dword [eax - 0x6316ce8f], ebx
sbb dword [ecx], esi
std
adc byte [0x5efc1515], dl
pop ss
adc eax, 0x31719815
jmp 0x9f7a0c3f

Function at 0x40891d
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
call fcn.00408941
xor dword [edi], ebx
mov edx, 0x9122b07d
inc edi
and esi, esi
cmp edi, ecx
jne fcn.0040891d
mov edx, esi
sub edx, esi
ret

Function at 0x4738cc
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], 0x4735cc
pop esi
sub edx, 0xd8c7c572
call fcn.0047390c
sub ecx, ecx
add edx, 0xf6dd5106
xor dword [edi], esi
sub edx, 0xb17cf54c
or ecx, ecx
add edi, 2
mov ecx, 0x4e5dcafe
cmp edi, ebx
jl fcn.004738cc
add edx, 1
ret
Function at 0x401160
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
xor esi, esi
nop word [eax + eax]
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x95
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x99
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xe2
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0xb3
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x42
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xce
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x9b
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x64
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xe8
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x79
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x78
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xde
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x26
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x77
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0xc2
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x29
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xb4
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x6b
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x36
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0xfd
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xe3
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xc4
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x2e
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xbd
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xd
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x86
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x44
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x68
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xfd
inc esi
cmp esi, 0x2d200
jb 0x401170
pop edi
pop esi
ret
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219

Function at 0x40354a
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x403573
mov al, byte [esi + 1]
inc esi
test al, al
je 0x40356b
cmp al, 0x22
jne 0x40355f
cmp byte [esi], 0x22
jne 0x40357d
inc esi
jmp 0x40357d
cmp al, 0x20
jle 0x40357d
inc esi
cmp byte [esi], 0x20
jg 0x403577
mov al, byte [esi]
test al, al
je 0x403587
cmp al, 0x20
jle 0x403570
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00401df7
push 0x404004
push section..data
call fcn.00403530
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x4035b7
movzx eax, word [ebp - 0x14]
jmp 0x4035ba
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.004035dd
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401160
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
xor esi, esi
nop word [eax + eax]
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x50
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xad
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xb1
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x5f
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x7c
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x3b
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0xa7
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xc6
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xae
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0xd2
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x46
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xf9
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xd5
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x75
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x7f
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xe1
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x26
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xd5
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xb
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x5f
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 2
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xc4
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x20
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xb
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xd1
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xef
push 0
push 0
push 0
call edi
xor byte [esi + section..BsS], 0x32
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0x5f
push 0
push 0
push 0
call edi
add byte [esi + section..BsS], 0xa
inc esi
cmp esi, 0x2d200
jb 0x401170
pop edi
pop esi
ret
Function at 0x4018c0
Capabilities:
Access peb ldr_data
Create thread
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x41800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetMessageExtraInfo]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
clc
jae 0x4018e4
call 0x63d11b
add byte [eax], al
mov eax, 0x23
cmp eax, 0x100
jl 0x4018f2
call 0x3dcb7da8
xor byte [eax], al
add byte [eax], al
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x447200], eax
stc
jb 0x401910
call 0xe84883fa
add al, 0xe
add byte [eax], al
push 8
call fcn.0040271b
add esp, 4
mov esi, eax
push 4
call fcn.0040271b
add esp, 4
lea edi, [esi + 4]
mov dword [eax], 0x4018b0
push edi
push 0
push eax
push 0x401c70
push 0
push 0
call fcn.0040555f
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x401a2b
cmp dword [edi], 0
je 0x401a38
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [edi], eax
je 0x401a3f
push 0
push dword [esi + 4]
push dword [esi]
call fcn.0040230e
add esp, 0xc
test eax, eax
jne 0x401a46
push 0xc
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [ebp - 0x10], 0x422e28f6
mov dword [ebp - 0xc], 0x440762a0
mov dword [ebp - 8], 0x3f443958
call fcn.0040271b
add esp, 4
mov edi, eax
lea eax, [ebp - 0x10]
push 0xc
push eax
push edi
lea esi, [edi + 0xc]
call fcn.00403610
add esp, 0xc
xor dl, dl
mov ebx, edi
cmp edi, esi
je 0x4019e9
movss xmm1, dword [0x415b5c]
movss xmm0, dword [ebx]
mov cl, dl
comiss xmm0, xmm1
lea eax, [ecx + 1]
movzx edx, al
movzx eax, cl
cmovbe edx, eax
add ebx, 4
cmp ebx, esi
jne 0x4019c3
cmp dl, 5
jbe 0x4019e9
or ebx, 0xffffffff
jmp 0x4019eb
xor ebx, ebx
test edi, edi
je 0x401a18
sub esi, edi
and esi, 0xfffffffc
cmp esi, 0x1000
jb 0x401a0e
mov ecx, dword [edi - 4]
add esi, 0x23
sub edi, ecx
lea eax, [edi - 4]
cmp eax, 0x1f
ja 0x401a4d
mov edi, ecx
push esi
push edi
call fcn.0040274b
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040270d
mov esp, ebp
pop ebp
ret
push 6
mov dword [edi], 0
call fcn.004020b0
push 1
call fcn.004020b0
push 5
call fcn.004020b0
push 2
call fcn.004020b0
call fcn.0040590c
int3

Function at 0x402cd6
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x402d15
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x402d15
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x402d15
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x402d15
cmp dword [ecx + 0x74], 0xe
jbe 0x402d15
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x407a04
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41227c
push 0x412274
push str.FlsAlloc
push 0x1e
call fcn.00407885
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407a38
push dword [ebp + 8]
mov ecx, esi
call dword [0x410140]
call esi
jmp 0x407a3e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x407a82
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41228c
push 0x412284
push str.FlsGetValue
push 0x20
call fcn.00407885
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407ab9
push dword [ebp + 8]
mov ecx, esi
call dword [0x410140]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40f310
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f33d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f33d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x5d8aba
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x5d87dc
and ecx, ecx
dec eax
call fcn.005d8af5
mov ecx, 0x58b45db8
xor dword [edi], ebx
add eax, 1
mov ecx, 0x1bdfecca
or ecx, ecx
add edi, 2
sub ecx, ecx
cmp edi, esi
jl fcn.005d8aba
inc ecx
and ecx, ecx
sub eax, 0xf912cd6b
ret

Function at 0x710c55
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x7109ec
inc ecx
dec eax
add ecx, 0xf3bb3efe
call fcn.00710ca4
and eax, eax
push 0x81f4d2d8
pop ecx
xor dword [edi], edx
push 0x54886f20
pop ecx
or eax, ecx
push 0x8f7d6a4f
mov ecx, dword [esp]
add esp, 4
inc edi
sub ecx, eax
add eax, 0x5c72d2e0
cmp edi, ebx
jne fcn.00710c55
sub eax, ecx
sub esp, 4
mov dword [esp], ecx
pop eax
ret
Function at 0x100296b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
xor esi, esi
cmp dword [0x1006080], esi
je 0x10029d5
lea eax, [ebp - 8]
push eax
push 1
push esi
push 0x10029f8
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x10029cf
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0x10029e0
push dword [ebp - 8]
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x1003498
push dword [ebp - 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov dword [0x1006080], esi
mov eax, dword [0x10064a4]
pop esi
leave
ret
cmp dword [ebp - 4], esi
setne al
mov dword [0x10064a4], eax
jmp 0x10029c6

Function at 0x1002be9
Capabilities:
Encode data using xor

Disassembly:
call fcn.01002b19
push 0x58
push 0x1002d08
call fcn.01002ac7
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
jmp 0x1005e80
inc ecx
not cl
jmp 0x1005f08
push 0x6a64
clc
pop eax
jmp 0x1005f6f
not dh
xchg dh, ch
nop
mov edx, 0xb43e8a9f
jge 0x1005f6f
dec eax
dec ecx
test ecx, ecx
jmp fcn.0100ec14
adc ch, dh
not ecx
sub eax, 2
jmp 0x1005ec8
sbb word [eax + 0x1008600], 0x4fbc
jmp 0x1005e49