joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4027ad
Capabilities:
Print debug messages

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
mov edi, ecx
push str.StartDownload....
call esi
push str.m_lpszGPCFullURL:
call esi
lea ebp, [edi + 0xb2c]
push ebp
call esi
push str.m_lpszSectionName:
call esi
lea ebx, [edi + 0x628]
push ebx
call esi
push str.m_lpszIniName:
call esi
lea eax, [edi + 0x72c]
push eax
mov dword [esp + 0x14], eax
call esi
push str.m_szHost:
call esi
add edi, 0x212c
push edi
call esi
push 0x4070ac
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0
push 0x402415
test eax, eax
push ebx
jne 0x402823
push dword [esp + 0x1c]
jmp 0x402824
push ebp
call sub.ieatgpc.DLL_Ordinal_7
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x402f4b
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 7
call fcn.0040325f
test eax, eax
je 0x402f66
push 0xffffffffffffffff
push 0
push eax
call fcn.00403516
add esp, 0xc
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0xf060
push 0x112
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
ret
Function at 0x40378a
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
mov eax, 0x40440c
call fcn.00403f00
sub esp, 0x810
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x403815
push edi
mov dword [ebp - 0x10], ebx
push 0xf003f
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
push Ordinal_5
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.00403959
mov edx, eax
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x81b]
mov byte [ebp - 0x81c], bl
cmp edx, ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x18], 0x800
pop edi
jne 0x403819
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
push eax
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x403819
cmp dword [ebp - 0x10], ebx
je 0x403815
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x403876
push esi
push 0x407df0
lea ecx, [ebp - 0x14]
call fcn.004038c4
push dword [ebp + 8]
lea eax, [ebp - 0x81c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x14]
push str._s__s
push eax
call fcn.00403997
add esp, 0x10
push 5
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x20
mov byte [ebp - 4], bl
pop ecx
cmp ecx, eax
lea ecx, [ebp - 0x14]
sbb esi, esi
neg esi
call fcn.00403898
cmp dword [ebp - 0x10], ebx
je 0x403873
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1000c4df
Capabilities:
Encode data using xor

Disassembly:
sub al, byte [eax]
inc ecx
popal
push cs
stc
jae 0x1000c547
jl 0x1000c568
in eax, dx
ficom word [ebx + 0xe4338a2]
in al, 0x14
xchg ecx, eax
hlt
push es
insb byte es:[edi], dx
inc dword [ebx + esi*8]
push ebp
ror dword [esi - 0x647b9f66], 0xd4
test eax, 0xb7337ab9
and dword [eax], eax
inc esi
retf
mov ebx, 0xfb1519be
add al, 0xf4
insb byte es:[edi], dx
adc eax, 0x6cf404fb
xor edi, edx
pop es
and byte [ecx - 0x52], cl
dec ecx
scasb al, byte es:[edi]
add al, 0x6b
jle 0x1000c56b
lcall 0xe1a1, 0x5ba0e9d5
mov cl, 0xb8
clc
pop esi
jge 0x1000c582
mov eax, 0xfb7d5ef8
mov esi, 0x73ef3a38
xchg dword [0x7f8a682], edi
inc ecx
push ss
jno 0x1000c574
inc edx
push 0xffffffffffffff9c
loop 0x1000c613
retf
inc ebp
push esi
inc ebx
in eax, 0xe5
ror dword [ecx - 0x2816edaf], 0x1a
and dword [ecx - 0x4f], eax
jno 0x1000c594
push ecx
adc ch, cl
xlatb
sbb ah, byte [ecx]
inc ecx
mov cl, 0x71
invalid
fsubrp st(7)
shr dword [edx - 0x4f806912], cl
dec ebx
insb byte es:[edi], dx
push ss
mov esp, 0xc629122a
sub dl, byte [edx]
sub esi, eax
jge 0x1000c5ab
fidiv dword [ebx + 0x7df24ed1]
movsb byte es:[edi], byte gs:[esi]
fild word [eax]
mov al, 0x2f
mov al, 0xc7
lodsd eax, dword [esi]
jns 0x1000c633
sahf
fcmovb st(0), st(5)
push ss
cmp al, 0x82
nop
loop 0x1000c63d
ja 0x1000c5f6
sbb dh, byte [edi]
bound ecx, qword cs:[esi - 0x66]
pushfd
adc dword [0xc5958d4b], ebx
sbb eax, 0xc5958d4b
dec esp
pushfd
outsd dx, dword [esi]
push sp
wait
dec esi
cwde
ja 0x1000c657
sahf
clc
push esi
out dx, eax
arpl cx, bp
mov byte [0xede58739], al
or byte cs:[eax + 0x4f], bl
mov esp, 0xfa7f5ff4
out 0xd4, al
or al, 0xc8
push eax
xchg ebx, eax
loop 0x1000c62a
shl byte [eax - 0x6ec55e53], cl
xchg edx, eax
stosb byte es:[edi], al
jp 0x1000c5fd
mov ah, 0xd4
sub eax, 0xbf7caf43
xor byte [eax + 0x2e], 0x2e
cmp esp, dword [edx - 0xb]
Function at 0x4192f8c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x4193023
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, eax
mov dl, 1
mov eax, dword [sym.imp.adortl60.bpl__Adodb_TADOQuery_]
call sub.adortl60.bpl__Adodb_TADOQuery__bctr_qqrp18Classes_TComponent
mov ebx, eax
call sub.VEDatasets.bpl__Vedataset_Connection_qqrv
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x268]
lea eax, [ebp - 4]
push eax
call sub.VEDatasets.bpl__Vedataset_FirmaNo_qqrv
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
call sub.VEDatasets.bpl__Vedataset_DonemNo_qqrv
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x419303c
call sub.rtl60.bpl__Sysutils_Format_qqrx17System_AnsiStringpx14System_TVarRecxi
mov eax, dword [ebp - 4]
push eax
mov eax, ebx
call sub.adortl60.bpl__Adodb_TADOQuery_GetSQL_qqrv
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, ebx
call sub.dbrtl60.bpl__Db_TDataSet_Open_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419302a
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x41a6dd0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x41a6dd8
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x41a6e92
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
push eax
or ecx, 0xffffffff
mov dl, 0x27
mov eax, dword [ebp - 4]
call sub.vegalib60.bpl__Strtools_QS_qqr17System_AnsiStringci
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
mov esi, dword [ebx + 0x30c]
mov eax, dword [esi + 0x2cc]
push eax
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [esi + 0x2c8]
mov edx, 0x41a6eac
mov eax, dword [0x419a8d8]
call fcn.0419aea4
mov ecx, dword [ebp - 0x24]
mov edx, dword [sym.imp.VEDatasets.bpl__Vedataset_defConnection]
mov edx, dword [edx]
mov eax, dword [0x419a8d8]
call fcn.0419a964
lea eax, [ebp - 0x14]
call sub.rtl60.bpl__System__VarToInt_qqrrx14System_Variant
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a6e99
lea eax, [ebp - 0x24]
mov edx, 2
call sub.rtl60.bpl__System__LStrArrayClr_qqrpvi
lea eax, [ebp - 0x14]
call sub.rtl60.bpl__System__VarClr_qqrr14System_Variant
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret
Function at 0x401764
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x401c28
call fcn.00401a28
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x4017c4
cmp eax, 0xffffffff
je 0x4017c4
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x4017bd
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x4017bd
cmp edx, 0x10000000
jae 0x4017bd
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x4017ba
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x401830
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40186e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x401866
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x401870
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x401856
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x401940
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x401971
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x401971
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x401971
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x406217
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x41771b
call fcn.004117f0
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
push 8
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
pop edi
mov edx, 0x419210
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x419238
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call fcn.00409525
push dword [esi + 8]
mov ecx, ebx
call fcn.00409525
push dword [esi + 0xc]
mov ecx, edi
call fcn.00409525
push dword [esi + 0xc]
mov ecx, edi
call fcn.00409525
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x40ef77
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov edx, dword [ecx]
and edx, 7
cmp dword [ebp + 0xc], 5
jb 0x40f0c7
add dword [ebp + 0x10], 5
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
mov ecx, dword [ebp + 8]
lea esi, [eax + ecx]
mov eax, dword [ebp + 0xc]
lea edi, [ecx + eax - 4]
cmp esi, edi
jae 0x40efb7
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x40efb7
inc esi
jmp 0x40efa8
mov eax, esi
sub eax, ecx
cmp esi, edi
mov dword [ebp - 8], eax
jae 0x40f0a7
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, 3
jbe 0x40efec
xor edx, edx
mov cl, byte [esi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x40f019
cmp cl, 0xff
je 0x40f019
and edx, 3
shl edx, 1
or edx, 1
inc eax
jmp 0x40ef9b
dec ecx
shl edx, cl
and edx, 7
je 0x40efd2
movzx ecx, byte [edx + 0x41970c]
mov edi, esi
sub edi, ecx
cmp byte [edx + 0x419704], 0
mov cl, byte [edi + 4]
je 0x40f014
test cl, cl
je 0x40f014
cmp cl, 0xff
jne 0x40efd2
mov dword [ebp - 4], eax
jmp 0x40efe1
xor ebx, ebx
mov bh, cl
mov bl, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
mov edi, ebx
cmp dword [ebp + 0x18], 0
je 0x40f042
lea ebx, [edi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x40f049
sub edi, eax
sub edi, dword [ebp + 0x10]
mov ebx, edi
test edx, edx
je 0x40f07d
movzx edi, byte [edx + 0x41970c]
push 0x18
mov eax, ebx
shl edi, 3
pop ecx
sub ecx, edi
shr eax, cl
test al, al
je 0x40f068
cmp al, 0xff
jne 0x40f07a
push 0x20
mov eax, dword [ebp - 8]
pop ecx
push 1
sub ecx, edi
pop edi
shl edi, cl
dec edi
xor edi, ebx
jmp 0x40f034
mov eax, dword [ebp - 8]
mov ecx, ebx
mov byte [esi + 1], bl
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [esi + 2], cl
add eax, 5
jmp 0x40ef9b
mov esi, eax
push 3
sub esi, dword [ebp - 4]
pop edi
lea ecx, [esi - 1]
shl edx, cl
and edx, 7
cmp edi, esi
sbb ecx, ecx
pop edi
not ecx
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
pop ebx
mov dword [edx], ecx
leave
ret 0x14

Function at 0x40f0ff
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
mov ecx, edx
mov edx, dword [esp + 4]
test edx, edx
jbe 0x40f12c
push esi
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x421b00]
xor eax, esi
inc ecx
dec edx
jne 0x40f10d
pop edi
pop esi
ret 4
Function at 0x10001000
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x10]
ret

Function at 0x10001020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
sub esp, 8
mov eax, dword [edx + 0x3c]
cmp dword [eax + edx + 0x7c], 0
je 0x100010ee
mov eax, dword [eax + edx + 0x78]
test eax, eax
je 0x100010ee
mov ecx, dword [eax + edx + 0x1c]
add ecx, edx
push ebx
mov ebx, dword [eax + edx + 0x20]
mov dword [ebp - 8], ecx
add ebx, edx
mov ecx, dword [eax + edx + 0x24]
push esi
mov esi, dword [eax + edx + 0x14]
add ecx, edx
push edi
mov dword [ebp - 4], ecx
xor edi, edi
xor ecx, ecx
sub esi, 1
je 0x100010e5
nop word [eax + eax]
mov eax, dword [ebx + ecx*4]
add eax, edx
cmp byte [eax], 0x47
jne 0x100010c8
cmp byte [eax + 1], 0x65
jne 0x100010c8
cmp byte [eax + 2], 0x74
jne 0x100010c8
cmp byte [eax + 3], 0x50
jne 0x100010c8
cmp byte [eax + 4], 0x72
jne 0x100010c8
cmp byte [eax + 5], 0x6f
jne 0x100010c8
cmp byte [eax + 6], 0x63
jne 0x100010c8
cmp byte [eax + 7], 0x41
jne 0x100010c8
cmp byte [eax + 8], 0x64
jne 0x100010c8
cmp byte [eax + 9], 0x64
jne 0x100010c8
cmp byte [eax + 0xa], 0x72
jne 0x100010c8
cmp byte [eax + 0xb], 0x65
jne 0x100010c8
cmp byte [eax + 0xc], 0x73
jne 0x100010c8
cmp byte [eax + 0xd], 0x73
je 0x100010d6
inc ecx
cmp ecx, esi
jb 0x10001070
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 8]
movzx eax, word [eax + ecx*2]
mov edi, dword [edi + eax*4]
add edi, edx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10001100
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10012004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x34], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
movaps xmm0, xmmword [0x10010af0]
mov dword [ebp - 0x30], eax
movups xmmword [ebp - 0x28], xmm0
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x14], 0x74726956
mov dword [ebp - 0x10], 0x506c6175
mov dword [ebp - 0xc], 0x65746f72
mov word [ebp - 8], 0x7463
mov byte [ebp - 6], 0
call fcn.10001000
mov ebx, eax
mov ecx, ebx
call fcn.10001020
mov edi, eax
lea eax, [ebp - 0x28]
push eax
push ebx
call edi
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push ebx
call edi
push 0
mov edi, eax
call esi
mov dword [ebp - 0x2c], eax
push eax
mov eax, 1
add eax, 2
sub eax, 3
add eax, dword [ebp - 0x30]
xor eax, eax
add eax, dword [ebp - 0x2c]
add eax, 0x4010
add eax, 0x51d0
mov dword [ebp - 0x2c], eax
pop eax
lea eax, [ebp - 0x38]
push eax
push 0x40
push 0x10
push dword [ebp - 0x2c]
call edi
push ebx
push esi
lea ebx, [0x10001220]
sub ebx, dword [ebp - 0x2c]
sub ebx, 2
sub ebx, 1
add ebx, 1
sub ebx, 1
sub ebx, 2
mov esi, dword [ebp - 0x2c]
mov al, 0xe9
mov byte ds:[esi], al
inc esi
mov dword [esi], ebx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x30]
xor ecx, ebp
add eax, dword [ebp - 0x34]
pop edi
pop esi
pop ebx
call fcn.10001497
mov esp, ebp
pop ebp
ret
Function at 0x517a7310
Capabilities:
Encode data using xor

Disassembly:
test ebx, 0x2209080c
and al, 0xba
mov dh, 0x89
sub edx, ecx
add ch, 0x32
movzx esi, di
sub edi, ebx
lea edi, [0x4cb638b0]
call 0x517a7331
xchg ch, cl
mov ecx, 0x3d2e9885
and ebp, edi
mov dl, al
imul ecx, ebp
or dh, 0x46
cmp ebx, eax
push 0
pop edx
movsx ebp, cl
sub ebx, esi
add al, ch
test al, cl
imul ebp, edi
mov bl, bh
test ebx, 0x318a8bad
imul ecx, esi
mov edi, 0x65fd
xor ebx, ebp
xor edi, 0x68df
xchg bl, al
xchg ebx, ebx
or ch, 0xe1
sbb eax, ebx
mov esi, 0xa4b2654f
add edx, edi
xchg ebp, esi
cmp eax, 0x7772bd1f
sub edx, 0xd21
dec ch
test edi, edx
sbb ebx, ecx
lea eax, [0x7853b4b8]
imul esi, ebp, 0x44a34a0e
mov ebp, ebp
dec edi
sub ah, dh
cmp edx, 0x1f6
jb 0x517a7348
pop eax
test ebp, edx
imul edi, eax, 0x7aab2f9
test edx, edi
lea edi, [0x91eb1360]
test eax, eax
add eax, 0x7aa5
dec ecx
mov ebp, ebp
add eax, 0x309
and ch, 0xf9
lea ebx, [0x13fe8edb]
imul ebx, esi, 0x601a2be1
imul edx, eax
imul esi, esi
dec edx
test cl, 0xe4
mov ebx, eax
cmp esi, ebx
test ebx, 0x8f8f8e35
mov ebp, 0x9dad964d
mov dh, 0x96
xchg bl, bh
lea ebx, [0xeaedbfe9]
adc dl, 0x4b
add ebp, 0xcc3c03ca
push eax
jno 0x517a741f
test ebx, 0xf3d5cb11
lea ebp, [0x6f5567ae]
adc ebp, eax
ret
Function at 0x4017a5
Capabilities:
Extract resource via kernel32 functions
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x4021bc
push 0x65
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x401862
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x401861
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401861
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0xf013f
push ebx
push 0x4021c0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401861
push edi
push esi
push 3
push ebx
push str.rutsstager
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x401861
call fcn.00401868
mov ebx, str.rutssvc32
mov esi, eax
mov ecx, ebx
call fcn.00401674
mov edi, str.rutssvc64
mov ecx, edi
call fcn.00401674
call fcn.0040112f
test eax, eax
push esi
cmove edi, ebx
push ecx
mov ecx, edi
call fcn.004011ad
pop ecx
pop ecx
test eax, eax
je 0x401861
mov ecx, edi
call fcn.0040151a
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x61b460
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1c1000]
push edi
or ebp, 0xffffffff
jmp 0x61b482
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x61b489
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x61b478
mov eax, 1
add ebx, ebx
jne 0x61b49b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x61b4ac
jne 0x61b4cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x61b4cb
dec eax
add ebx, ebx
jne 0x61b4b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x61b490
add ebx, ebx
jne 0x61b4c7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x61b51d
xor ecx, ecx
sub eax, 3
jb 0x61b4e3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x61b552
sar eax, 1
mov ebp, eax
jmp 0x61b4ee
add ebx, ebx
jne 0x61b4ee
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x61b4bc
inc ecx
add ebx, ebx
jne 0x61b4fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x61b4bc
add ebx, ebx
jne 0x61b509
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x61b4fe
jne 0x61b51a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x61b4fe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x61b53c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x61b52e
jmp 0x61b47e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x61b53c
add edi, ecx
jmp 0x61b47e
pop esi
mov edi, esi
mov ecx, 0xb62
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x61b55a
cmp byte [edi], 9
jne 0x61b55a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x61b55f
lea edi, [esi + 0x219000]
mov eax, dword [edi]
or eax, eax
je 0x61b5d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x21b960]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x21b99c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x61b58c
mov ecx, edi
jns 0x61b5bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x21b9a0]
or eax, eax
je 0x61b5d1
mov dword [ebx], eax
add ebx, 4
jmp 0x61b5a9
call dword [esi + 0x21b9a8]
mov ebp, dword [esi + 0x21b9a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x61b60b
sub esp, 0xffffff80
jmp 0x4059dc
Function at 0x4047f0
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x218
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x120]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], eax
push 0x4249a8
lea eax, [esp + 0x1c]
push eax
call esi
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x124]
push edx
call esi
lea eax, [esp + 0x18]
push 0x2e
push eax
call fcn.00408a50
add esp, 8
mov edi, eax
push edi
lea ecx, [esp + 0x14]
push ecx
call esi
push str..bu2
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x18]
push edx
call ebx
lea eax, [esp + 0x120]
push 0x2e
push eax
call fcn.00408a50
add esp, 8
push str..bu1
push eax
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x128]
push edx
call ebp
lea eax, [esp + 0x10]
push eax
push edi
call esi
push 0
lea ecx, [esp + 0x124]
push ecx
lea edx, [esp + 0x20]
push edx
call ebp
lea eax, [esp + 0x18]
push eax
call ebx
pop edi
mov eax, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4048d0
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x218
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x120]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], eax
push 0x4249a8
lea eax, [esp + 0x1c]
push eax
call esi
lea ecx, [esp + 0x18]
push 0x2e
push ecx
call fcn.00408a50
add esp, 8
push str..his
push eax
call esi
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x124]
push eax
call esi
lea ecx, [esp + 0x18]
push 0x2e
push ecx
call fcn.00408a50
add esp, 8
mov edi, eax
push edi
lea edx, [esp + 0x14]
push edx
call esi
push str..hi2
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x18]
push eax
call ebx
lea ecx, [esp + 0x120]
push 0x2e
push ecx
call fcn.00408a50
add esp, 8
push str..hi1
push eax
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x128]
push eax
call ebp
lea ecx, [esp + 0x10]
push ecx
push edi
call esi
push 0
lea edx, [esp + 0x124]
push edx
lea eax, [esp + 0x20]
push eax
call ebp
lea ecx, [esp + 0x18]
push ecx
call ebx
pop edi
mov eax, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret