joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4089ed
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 4], str.Bitmap_Window
mov al, byte [ebp + 0x14]
mov byte [0x4155cc], al
mov ecx, dword [ebp + 8]
mov dword [0x4155bc], ecx
mov edx, dword [ebp + 0xc]
mov dword [0x4155b8], edx
xor eax, eax
mov al, byte [0x4155cd]
test eax, eax
jne 0x408a93
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x30], 0x408b39
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
xor ecx, ecx
mov cl, byte [0x4155cc]
neg ecx
sbb ecx, ecx
and ecx, 0xfffffffe
add ecx, 0x7f02
push ecx
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
mov byte [0x4155cd], 1
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [0x4155bc]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0xc], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [0x4155b8]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 8], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 0
push 0
mov ecx, dword [0x4155b8]
push ecx
mov edx, dword [0x4155bc]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0x80000000
push str.Loading...
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
and eax, 0xff
neg eax
sbb eax, eax
and eax, 8
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4155c0], eax
push 5
mov ecx, dword [0x4155c0]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x4155c0]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
cmp dword [0x4155c0], 0
setne al
mov esp, ebp
pop ebp
ret
Function at 0x40b6e7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4129e0
cmp edx, dword [eax]
je 0x40b709
add eax, 8
inc ecx
cmp eax, 0x412a70
jl 0x40b6fa
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4129e0]
jne 0x40b837
mov eax, dword [0x415600]
cmp eax, 1
je 0x40b811
test eax, eax
jne 0x40b73a
cmp dword [0x412724], 1
je 0x40b811
cmp edx, 0xfc
je 0x40b837
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40b771
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004096d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00409cf0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40b7b4
lea eax, [ebp - 0x1a4]
push eax
call fcn.00409cf0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41058c
push edi
call fcn.00409d70
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004096d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004096e0
lea eax, [ebp - 0xa0]
push 0x41056c
push eax
call fcn.004096e0
push dword [esi + 0x4129e4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004096e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040dc58
add esp, 0x2c
pop edi
jmp 0x40b837
lea eax, [ebp + 8]
lea esi, [esi + 0x4129e4]
push 0
push eax
push dword [esi]
call fcn.00409cf0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10008030
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1000803f
pop dword [ebp - 8]
mov eax, 0x1000803f
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xecb7b19f
add dword [ebp - 0x18], 0x619a93ac
mov dword [ebp - 0x14], 0xf327bf5c
sub dword [ebp - 0x14], 0xc0f47317
mov dword [ebp - 0x10], 0x8eb00bb2
add dword [ebp - 0x10], 0xbd9c387c
mov dword [ebp - 0xc], 0x7a431b3c
sub dword [ebp - 0xc], 0x7a431b3c
lea eax, [ebp - 0x18]
push eax
mov eax, 0xebdef42b
add eax, 0x2424fc09
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x50b61c29
add dword [ebp - 0x18], 0x23bc4d2d
mov dword [ebp - 0x14], 0x4c92108d
add dword [ebp - 0x14], 0xf4da50e8
mov dword [ebp - 0x10], 0x174806b
sub dword [ebp - 0x10], 0x9e0513ff
mov dword [ebp - 0xc], 0xed16afa2
sub dword [ebp - 0xc], 0xed16afa2
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x43567
push 0
call eax
mov ecx, 0xf7b0b098
add ecx, 0x84f8c65
mov ebx, eax
mov esi, 0x8c2e8b28
sub esi, 0x7c293d28
add esi, dword [ebp - 8]
mov edx, 0xb5df20fc
add edx, 0xd9793165
xor dword [ebp - 4], ebx
mov edi, dword [esi]
sub dword [ebp - 4], 0x6c86d956
xor edi, edx
mov dword [ebx], edi
add ebx, 0xf4b481a3
sub ebx, 0xf4b4819f
add esi, 0xd57517a1
add esi, 0x2a8ae863
loop 0x10008157
add eax, 0x97747fe0
add eax, 0x688c66e7
xor ebx, ebx
add ebx, eax
add eax, 0xaca319cf
add eax, 0x535ce636
mov ecx, 0x4fd1dc5d
sub ecx, 0x3fd1dc5d
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x412c9e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cwde
pop ss
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004128e1
push eax
push esi
push dword [ebp + 8]
call fcn.00412896
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004128e1
push eax
push esi
push dword [ebp + 8]
call fcn.00412896
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004128d1
inc eax
fisub dword [ebx]
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.004128d1
cmpsd dword [esi], dword es:[edi]
pushal
xchg byte [ebp - 0x73], ch
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]
sbb al, 0xfb
invalid

Function at 0x413197
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
Function at 0x4131e5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.004128e1
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00412896
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
dec dword [ebx - 0x3d87a3a]
invalid
jmp [edi - 0x3d77a3a]
invalid
invalid
out dx, al
lea eax, [ebp - 0x3ec]
push eax
call fcn.004128e1
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00412896
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.004128d1
xchg ebx, eax
adc eax, dword [eax + eax*4]
movsd dword es:[edi], dword [esi]
int3

Function at 0x413ccd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [ebx + 0x448dfc4d]
add ebx, esp
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.00412842
add esp, 0xc
and dword [ebp - 0x700], 0
inc dword [eax]
jmp 0x413cde
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x413d27
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x413cd1
call fcn.004128d1
pop ecx
xor dl, bl
rol byte [eax - 0x72b5b], cl
inc dword [eax]
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.004128d1
cmp bh, dh
pop ebx
mov bl, 0x8d
test esp, edx
clc
invalid
Function at 0x414ab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
sbb al, 0xad
cmp byte [eax + 0x1c], 0x18
je 0x414a95
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.004128d1
push edx
xor ecx, edx
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.004128d1
jno 0x414a84
cmovns ecx, dword es:[ebx - 0x8fc74cc]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x414abe
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x414abe
call fcn.004128d1
test dword [edx], ebp
sbb dl, byte [eax]
mov ebx, dword [edx + 0x24]
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.004128d1
std
lodsb al, byte [esi]
dec esp
push 0xffffffffffffffff
jne 0x414b08
push dword [ebp + 4]
push dword [ebp]
call fcn.004130d1
mov esp, ebp
pop ebp
ret
in eax, 0xff
dec dword [ebx - 0x7a3ca21b]
push dword [ebx + ebx*8 - 0x7b]
invalid
Function at 0x10001110
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
mov ebx, dword [0x100087b4]
lea eax, [esp + 4]
push esi
push edi
push eax
push 2
push 0
push dword [0x100087b0]
mov esi, edx
mov edi, ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10001162
push esi
push edi
push 3
push eax
push ebx
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0xc]
neg eax
sbb esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
lea eax, [esi + 1]
pop esi
pop ebx
pop ecx
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x10001170
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push ebp
push esi
push edi
push eax
push 1
xor esi, esi
mov edi, edx
push esi
push dword [0x100087b0]
mov ebp, ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100011fa
push edi
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 3
push eax
push esi
push dword [0x100087b4]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100011f0
push 4
push 0x3000
push dword [edi]
push eax
call dword [0x10008728]
mov dword [ebp], eax
test eax, eax
je 0x100011f0
push edi
push eax
lea eax, [esp + 0x18]
push eax
push esi
push dword [0x100087b4]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb esi, esi
inc esi
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 8
ret

Function at 0x10001630
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push 0
push 0x10001210
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000165a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x10001830
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [section..data]
mov bl, dl
push esi
mov esi, ecx
push edi
mov edi, ebp
mov al, byte [esi]
test al, al
je 0x1000186d
mov dl, byte [0x10006011]
nop dword [eax]
mov cl, byte [esi + 1]
lea esi, [esi + 2]
shl al, 4
sub cl, 0x61
sub al, 0x10
or al, cl
xor al, dl
xor al, bl
mov byte [edi], al
inc edi
mov al, byte [esi]
test al, al
jne 0x10001850
lea ecx, [edi + 1]
mov byte [edi], 0
pop edi
pop esi
mov eax, ebp
mov dword [section..data], ecx
pop ebp
pop ebx
ret
Function at 0x10001bc0
Capabilities:
Encode data using xor
Link many functions at runtime

Disassembly:
push ebx
mov bl, byte [0x10006011]
mov edx, str.lblbkgpolelpkhlolmlplblepnldlelopoldlpln
push esi
push edi
mov edi, dword [section..data]
mov cl, 0x6c
mov esi, edi
nop dword [eax + eax]
mov al, byte [edx + 1]
lea edx, [edx + 2]
shl cl, 4
lea esi, [esi + 1]
sub cl, 0x10
sub al, 0x61
or cl, al
xor cl, bl
xor cl, 0xd0
mov byte [esi - 1], cl
mov cl, byte [edx]
test cl, cl
jne 0x10001be0
lea eax, [esi + 1]
mov byte [esi], cl
push 0x10006010
push edi
mov dword [section..data], eax
call section..text
add esp, 8
test eax, eax
je 0x10001d8a
push 0x8007
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
call fcn.100026b0
test eax, eax
je 0x10001d8a
push dword [0x10008760]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call ebx
mov edi, eax
test edi, edi
je 0x10001d8a
push dword [0x10008764]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
call esi
mov dword [0x10008730], eax
test eax, eax
je 0x10001d8a
push dword [0x10008768]
push edi
call esi
mov dword [0x10008728], eax
test eax, eax
je 0x10001d8a
push dword [0x1000876c]
push edi
call esi
mov dword [0x1000874c], eax
test eax, eax
je 0x10001d8a
push dword [0x10008770]
call ebx
mov edi, eax
test edi, edi
je 0x10001d8a
push dword [0x10008774]
push edi
call esi
mov dword [0x10008738], eax
test eax, eax
je 0x10001d8a
push dword [0x10008778]
push edi
call esi
mov dword [0x10008754], eax
test eax, eax
je 0x10001d8a
push dword [0x1000877c]
push edi
call esi
mov dword [0x10008734], eax
test eax, eax
je 0x10001d8a
push dword [0x10008780]
push edi
call esi
mov dword [0x10008758], eax
test eax, eax
je 0x10001d8a
push dword [0x10008784]
push edi
call esi
mov dword [0x10008748], eax
test eax, eax
je 0x10001d8a
push dword [0x10008788]
push edi
call esi
mov dword [0x10008750], eax
test eax, eax
je 0x10001d8a
push dword [0x1000878c]
push edi
call esi
mov dword [0x10008740], eax
test eax, eax
je 0x10001d8a
push dword [0x10008790]
push edi
call esi
mov dword [0x10008744], eax
test eax, eax
je 0x10001d8a
push dword [0x10008794]
push edi
call esi
mov dword [0x1000872c], eax
test eax, eax
je 0x10001d8a
push dword [0x10008798]
call ebx
test eax, eax
je 0x10001d8a
push dword [0x1000879c]
push eax
call esi
mov dword [0x1000873c], eax
test eax, eax
je 0x10001d8a
push 0
push 0
call eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10001d90
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x64
lea eax, [esp]
push ebx
push ebp
push esi
push edi
push ecx
push eax
mov ebx, edx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebp, dword [esp + 0x78]
xor esi, esi
nop dword [eax]
cmp esi, 0xffffffff
jae 0x10001e15
push ebp
push ebx
sub esp, 8
lea ecx, [esp + 0x20]
call fcn.100018d0
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x10001de2
mov eax, dword [ebx]
test eax, eax
je 0x10001ddf
push 0x8000
push edi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
inc esi
jmp 0x10001db0
cmp dword [ebp], 0x400
jbe 0x10001e08
mov ecx, dword [ebx]
mov eax, 0x5a4d
mov word [ecx], ax
mov eax, dword [ecx + 0x3c]
mov ecx, dword [ecx + eax]
xor eax, eax
cmp ecx, 0x4550
sete al
je 0x10001e17
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x64
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret

Function at 0x10001e20
Capabilities:
Terminate process

Disassembly:
sub esp, 8
lea edx, [esp + 4]
lea ecx, [esp]
push esi
call fcn.10001170
test eax, eax
jne 0x10001e63
mov ecx, dword [0x100087ac]
lea eax, [esp + 8]
sub esp, 8
lea edx, [esp + 0xc]
push eax
call fcn.10001d90
add esp, 0xc
test eax, eax
je 0x10001e9b
mov esi, dword [esp + 4]
mov ecx, esi
mov edx, dword [esp + 8]
call fcn.10001110
jmp 0x10001e67
mov esi, dword [esp + 4]
mov ecx, esi
call fcn.10002100
test eax, eax
je 0x10001e94
mov edx, dword [0x100087c8]
mov ecx, eax
call fcn.10002560
test eax, eax
je 0x10001e94
push 0
push 0
push dword [0x10006014]
push 0x72ecb505
call eax
mov ecx, esi
call fcn.10001ba0
call sub.ole32.dll_CoUninitialize
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10001eb0
Capabilities:
Terminate process

Disassembly:
push 0x16f30
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10001bc0
test eax, eax
je 0x10001ec9
call fcn.10001e20
push 0x58
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10001ee0
Capabilities:
Query or enumerate registry value
Terminate process

Disassembly:
sub esp, 0x1c
push esi
push 0x16f30
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10001bc0
test eax, eax
je 0x10001f83
cmp dword [esp + 0x24], 0xb
jne 0x10001f0b
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [0x100087b8]
lea eax, [esp + 0x24]
push eax
push 1
push 0
push dword [0x100087b0]
mov dword [esp + 0x14], 0x14
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10001f8c
lea eax, [esp + 4]
mov dword [esp + 8], 1
push eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push esi
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x24]
neg eax
sbb esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 1
je 0x10001f8c
push dword [0x100087bc]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x10001f8c
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
call fcn.10001630
call fcn.10001e20
int3
Function at 0x10002610
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x454
xor eax, eax
push esi
mov word [esp + 0x58], ax
lea eax, [esp + 0x58]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x44
lea eax, [esp + 0x18]
push 0
push eax
call fcn.10001730
add esp, 0xc
mov dword [esp + 0x14], 0x44
xor eax, eax
mov dword [esp + 0x40], 1
mov word [esp + 0x44], ax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x78]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
test esi, esi
je 0x1000269b
mov eax, dword [esp + 8]
test eax, eax
je 0x1000268a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 4]
test eax, eax
je 0x10002699
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x454
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0xfb0704c
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x2cad54ac
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401000
Capabilities:
Parse pe header

Disassembly:
push esi
mov eax, dword [0x403010]
mov dword [eax], 1
mov eax, dword [0x403014]
mov dword [eax], 1
mov eax, dword [0x403018]
mov dword [eax], 1
mov ecx, dword [0x403004]
movzx edx, word [ecx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x40107c
mov edx, dword [ecx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x40107c
add ecx, edx
movzx edx, word [ecx + 0x18]
add ecx, 0x18
cmp edx, 0x20b
je 0x401068
cmp edx, 0x10b
jne 0x40107c
cmp dword [ecx + 0x5c], 0xf
jb 0x40107c
add ecx, 0xd0
jmp 0x401074
cmp dword [ecx + 0x6c], 0xf
jb 0x40107c
add ecx, 0xe0
xor eax, eax
cmp dword [ecx], 0
setne al
mov ecx, dword [0x40300c]
cmp dword [ecx], 1
mov dword [0x40506c], eax
mov eax, 2
sbb eax, 0
push eax
call sym.__set_app_type
add esp, 4
mov eax, dword [0x403040]
mov esi, dword [eax]
call sym.___p__fmode
mov dword [eax], esi
mov eax, dword [0x403038]
mov esi, dword [eax]
call sym.___p__commode
mov dword [eax], esi
call dbg._setargv
mov eax, dword [section..rdata]
cmp dword [eax], 1
jne 0x4010d3
push dbg._matherr
call dbg.__mingw_setusermatherr
add esp, 4
xor eax, eax
pop esi
ret

Function at 0x401310
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x40300c]
mov dword [eax], 0
jmp dbg.__tmainCRTStartup

Function at 0x4019c0
Capabilities:
Write file on windows

Disassembly:
push esi
push eax
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
mov dword [esp], eax
push 2
call sym.___acrt_iob_func
add esp, 4
push eax
push 1
push 0x1b
push str.Mingw_w64_runtime_failure:_n
call sym._fwrite
add esp, 0x10
push 2
call sym.___acrt_iob_func
add esp, 4
push dword [esp]
push esi
push eax
call dbg.vfprintf
add esp, 0xc
call sym._abort
int3