joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469779
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bdfa5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4f9004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0xf
mov byte [esi + 0x20], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
lea ecx, [esi + 0x48]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov dword [esi + 0x68], 0xffffffff
mov dword [esi + 0x64], 0xffffffff
push 0
push 0x4c3a52
mov byte [ebp - 4], 1
mov dword [esi + 0x60], 4
mov byte [esi + 0x6c], 0
mov byte [esi + 0x40], 0
mov dword [esi + 0x44], 0
call fcn.00404f26
mov dword [esi + 0x68], 0
mov eax, esi
mov dword [esi + 0x64], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x492354
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
xor dl, dl
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 8], eax
push ebp
push esi
push edi
test bl, 3
jne 0x492485
test al, 3
jne 0x492485
mov edi, ecx
mov dword [esp + 0x10], 0
shr edi, 2
xor esi, esi
test edi, edi
je 0x492440
cmp edi, 8
jb 0x492409
mov ebp, dword [esp + 0x20]
mov edx, edi
mov dword [esp + 0x14], ebx
and edx, 0xfffffff8
add eax, 0x10
xorps xmm3, xmm3
sub dword [esp + 0x14], ebp
xorps xmm2, xmm2
mov ebp, dword [esp + 0x14]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebx + esi*4]
add esi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp esi, edx
jb 0x4923b8
mov eax, dword [esp + 0x20]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd dword [esp + 0x10], xmm2
cmp esi, edi
jae 0x492444
mov ebp, ebx
lea edx, [eax + esi*4]
sub ebp, eax
mov dword [esp + 0x14], ebp
mov ebp, edi
mov ebx, dword [esp + 0x14]
sub ebp, esi
mov esi, edi
mov edi, dword [esp + 0x10]
mov eax, dword [edx + ebx]
lea edx, [edx + 4]
xor eax, dword [edx - 4]
or edi, eax
sub ebp, 1
jne 0x492426
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x10], edi
jmp 0x492448
xor edi, edi
jmp 0x492448
mov edi, dword [esp + 0x10]
shl esi, 2
sub ecx, esi
jne 0x49245c
test edi, edi
pop edi
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
add ebx, esi
mov ebp, dword [esp + 0x20]
mov edx, eax
shr eax, 0x10
add ebp, esi
shr edx, 0x18
or dl, al
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x10]
shr eax, 8
or dl, al
mov eax, ebp
or dl, byte [esp + 0x10]
xor edi, edi
test ecx, ecx
je 0x492548
cmp ecx, 0x20
jb 0x492529
mov esi, ecx
add eax, 0x10
and esi, 0xffffffe0
xorps xmm3, xmm3
mov dword [esp + 0x1c], esi
xorps xmm2, xmm2
mov esi, ebx
sub esi, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x10]
nop dword [eax + eax]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [edi + ebx]
add edi, 0x20
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [eax + ebp - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, esi
jb 0x4924c4
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
mov ebp, dword [esp + 0x14]
cmp edi, ecx
jae 0x492548
sub ebx, ebp
lea esi, [edi + ebp]
sub ecx, edi
mov al, byte [ebx + esi]
lea esi, [esi + 1]
xor al, byte [esi - 1]
or dl, al
sub ecx, 1
jne 0x492538
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x4071ae
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov cl, 0x22
mov al, byte [esi]
cmp al, cl
jne 0x4071da
mov al, byte [esi + 1]
inc esi
cmp al, cl
je 0x4071d3
test al, al
jne 0x4071c7
cmp byte [esi], cl
jne 0x4071e4
inc esi
jmp 0x4071e4
cmp al, 0x20
jle 0x4071e4
inc esi
cmp byte [esi], 0x20
jg 0x4071de
mov al, byte [esi]
test al, al
je 0x4071ee
cmp al, 0x20
jle 0x4071d7
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x407208
movzx ebx, word [ebp - 0x14]
jmp 0x40720b
push 0xa
pop ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
push 0
push 0
push edi
call fcn.00407e1e
test eax, eax
je 0x407297
push 0
push edi
call fcn.004072a6
pop ecx
pop ecx
call fcn.00407700
test eax, eax
je 0x40725d
push edi
push 1
call fcn.00407727
pop ecx
test eax, eax
pop ecx
je 0x40725d
push 0
push str.This_Demo_of_LabWindows_CVI_has_expired.
push 0x40a7d0
call fcn.004080bb
add esp, 0xc
or esi, 0xffffffff
jmp 0x407289
cmp dword [0x414438], 0
je 0x407273
push section..text
push esi
call sub.cvirte.dll___CreatePtrInfoForWinMainCommandLine
pop ecx
pop ecx
push ebx
push esi
push 0
push edi
call section..text
mov esi, eax
call fcn.00407cc8
call fcn.00407d55
call fcn.00407f02
push edi
call fcn.0040736a
pop ecx
jmp 0x40729a
or esi, 0xffffffff
push esi
call fcn.004083fe
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407727
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
and byte [ebp - 1], 0
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0xc], ebx
call fcn.00407718
push ebx
mov edi, eax
mov esi, edx
call sub.cvirte.dll_time
pop ecx
xor ecx, ecx
cmp esi, ecx
jl 0x40777e
jg 0x407758
cmp edi, eax
jbe 0x40777e
sub edi, eax
mov eax, 0x3e8
sbb esi, ecx
add dword [ebp - 0xc], edi
adc ebx, esi
dec eax
jne 0x407761
cmp ebx, ecx
mov eax, 0x927c0
jg 0x407787
jl 0x407779
cmp dword [ebp - 0xc], eax
jae 0x407787
mov dword [ebp - 0xc], eax
jmp 0x407785
mov dword [ebp - 0xc], 0x927c0
xor ebx, ebx
cmp ebx, ecx
mov eax, 0xfc5d36bf
jg 0x40779a
jl 0x407797
cmp dword [ebp - 0xc], eax
jae 0x40779a
mov eax, dword [ebp - 0xc]
push 0x407a4e
push eax
push ecx
push ecx
call fcn.00407a24
xor ebx, ebx
mov dword [0x414380], eax
cmp eax, ebx
je 0x407889
cmp dword [ebp + 8], ebx
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
je 0x4077f3
call edi
push eax
lea eax, [ebp - 0x10c]
push 0x40a934
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x407889
push 0x104
push 0x41406c
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40782b
mov al, byte [str.Unknown_DLL_EXE]
test al, al
mov byte [0x41406c], al
je 0x40782b
xor eax, eax
mov cl, byte [eax + 0x40a945]
mov byte [eax + 0x41406d], cl
inc eax
test cl, cl
jne 0x40781a
call edi
push eax
lea eax, [ebp - 0x10c]
push str.CVI_Demo_Last_Time_Timer_Called___d
push eax
call esi
lea eax, [ebp - 0x10c]
push eax
push 4
push ebx
push 4
push ebx
push 0xffffffffffffffff
call fcn.0040832e
add esp, 0x24
cmp eax, ebx
mov dword [0x414384], eax
je 0x407889
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40786d
mov byte [ebp - 1], 1
push ebx
push ebx
push ebx
push 2
push dword [0x414384]
call fcn.004081fc
add esp, 0x14
cmp eax, ebx
mov dword [0x414388], eax
jne 0x40788e
push 1
pop eax
jmp 0x4078a3
cmp byte [ebp - 1], 0
je 0x4078a1
call fcn.004078a8
mov ecx, dword [0x414388]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4078bf
Capabilities:
Check mutex on windows
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
cmp dword [0x41438c], 0
je 0x4078d5
xor eax, eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x114]
push str.National_Instruments_LabWindows_CVI_Startup_library__d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [ebp - 8], eax
jne 0x40790e
push 0xfffffffffffffffd
pop eax
leave
ret
push ebx
push esi
push edi
or edi, 0xffffffff
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x41438c], 0
jne 0x407a09
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.winmm.dll
call esi
test eax, eax
mov dword [ebp - 0xc], eax
jne 0x407944
mov esi, edi
jmp 0x407a0b
push str.advapi32.dll
call esi
mov ebx, eax
test ebx, ebx
je 0x40793d
push 0x40a9cc
call esi
test eax, eax
mov dword [ebp - 4], eax
je 0x40793d
push 0x40a9dc
call esi
mov edi, eax
test edi, edi
jne 0x407974
or esi, 0xffffffff
jmp 0x407a0b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.timeGetTime
push dword [ebp - 0xc]
call esi
test eax, eax
mov dword [0x414378], eax
je 0x4079e4
push str.RegOpenKeyExA
push ebx
call esi
test eax, eax
mov dword [0x414374], eax
je 0x4079e4
push str.RegQueryValueExA
push ebx
call esi
test eax, eax
mov dword [0x414068], eax
je 0x4079e4
push str.GetFileTime
push dword [ebp - 4]
call esi
test eax, eax
mov dword [0x414370], eax
je 0x4079e4
push str.KillTimer
push edi
call esi
test eax, eax
mov dword [0x41437c], eax
je 0x4079e4
push str.SetTimer
push edi
call esi
test eax, eax
mov dword [0x414064], eax
jne 0x4079ff
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
push ebx
call esi
push dword [ebp - 4]
call esi
push edi
call esi
push 0xfffffffffffffffe
pop esi
jmp 0x407a0b
mov dword [0x41438c], 1
xor esi, esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40824b
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
xor edi, edi
cmp dword [0x414444], edi
je 0x408268
push 1
pop eax
jmp 0x4082eb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x108]
push str.National_Instruments_LabWindows_CVI_Startup_SDK_stubs__d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
cmp esi, edi
jne 0x40829d
xor eax, eax
jmp 0x4082eb
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x414444], edi
jne 0x4082d2
push 0x40aea0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, edi
mov dword [0x414444], eax
jne 0x4082d2
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x414444], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [0x414444], edi
setne al
pop edi
pop esi
leave
ret

Function at 0x430003
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
nop
nop
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x42ffcc
ror byte [eax + edx*4], 0x90
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x439940
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x29000]
push edi
jmp 0x43995a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x439961
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x439950
mov eax, 1
add ebx, ebx
jne 0x439973
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x439968
jne 0x439984
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x439968
xor ecx, ecx
sub eax, 3
jb 0x439998
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x439a0a
mov ebp, eax
add ebx, ebx
jne 0x4399a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4399b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4399d4
inc ecx
add ebx, ebx
jne 0x4399c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4399b5
jne 0x4399d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4399b5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4399f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4399e5
jmp 0x439956
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4399f4
add edi, ecx
jmp 0x439956
pop esi
mov edi, esi
mov ecx, 0xa57
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x439a12
cmp byte [edi], 0x12
jne 0x439a12
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x439a17
lea edi, [esi + 0x37000]
mov eax, dword [edi]
or eax, eax
je 0x439a8f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4dc44]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4dd24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x439a44
mov ecx, edi
jns 0x439a73
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4dd2c]
or eax, eax
je 0x439a89
mov dword [ebx], eax
add ebx, 4
jmp 0x439a61
call dword [esi + 0x4dd28]
mov ebp, dword [esi + 0x4dd30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x439ac3
sub esp, 0xffffff80
jmp 0x41942f
Function at 0x2e0140e6
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e0306ad
call fcn.2e001553
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
push ebx
push ebx
push 6
mov dword [ebp - 4], ebx
call fcn.2e01c470
add esp, 0xc
test al, al
je 0x2e0141a8
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e0141a8
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01419f
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e01c470
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014192
push esi
mov byte [ebp - 4], 2
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
pop ecx
push eax
push esi
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.2e010e73
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e01c470
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e00159d
ret

Function at 0x2e014c09
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x2e030723
call fcn.2e02e506
mov esi, dword [ebp + 8]
xor bl, bl
cmp dword [ecx + 0x10], 0
mov edi, dword [ebp + 0xc]
jbe 0x2e014cf9
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.2e014b12
push esi
mov dword [ebp - 4], 1
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.2e010dd2
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014cea
lea eax, [ebp - 0x30]
push eax
push 0
push 0x2e033925
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014ce1
mov eax, dword [ebp - 0x30]
inc eax
push eax
call fcn.2e01c470
mov esi, eax
pop ecx
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
push esi
push 0
push 0
push 0x2e033925
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014cd3
push esi
mov byte [ebp - 4], 3
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
pop ecx
push eax
push esi
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.2e010e73
inc bl
push 1
push esi
mov byte [ebp - 4], 0
call fcn.2e01c470
pop ecx
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 4
call fcn.2e01c470
mov al, bl
call fcn.2e02e4e4
ret 8
Function at 0x2e014d3b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e030750
call fcn.2e001553
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014d75
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014dea
lea eax, [ebp - 0x14]
mov edi, 0x2e033925
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014de1
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014de1
inc eax
push eax
call fcn.2e01c470
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014dd3
push esi
mov byte [ebp - 4], 1
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
pop ecx
mov ecx, dword [ebp + 0xc]
push eax
push esi
mov byte [ebp - 4], bl
call fcn.2e010e73
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e01c470
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e00159d
ret 8
Function at 0x2e01c470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x2e01c47f
pop dword [ebp - 0x24]
mov eax, 0xf6ef07f6
add eax, 0x3712bc89
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x4fbdab3c
sub dword [ebp - 0x34], 0x16b65f1
mov dword [ebp - 0x30], 0x1dc45a28
sub dword [ebp - 0x30], 0xeb910de3
mov dword [ebp - 0x2c], 0xfe55feaa
add dword [ebp - 0x2c], 0x4df64584
mov dword [ebp - 0x28], 0x309cac1c
add dword [ebp - 0x28], 0xcf6353e4
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x88a8cd85
add dword [ebp - 0x34], 0xebc99bd1
mov dword [ebp - 0x30], 0x784b3008
sub dword [ebp - 0x30], 0x36dece93
mov dword [ebp - 0x2c], 0xfa251522
add dword [ebp - 0x2c], 0x694a574a
mov dword [ebp - 0x28], 0xab243892
add dword [ebp - 0x28], 0x54dbc76e
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x419b2
push 0
call eax
mov ecx, 0x4b51
mov edx, eax
mov ebx, 0x9d8e444
add ebx, 0x242cabbc
add ebx, dword [ebp - 0x24]
mov edi, 0x5f054da0
sub edi, 0xc65af3b5
add dword [ebp - 0x10], 0x9f51ff21
mov esi, dword [ebx]
add dword [ebp - 0x10], 0xc9b73912
xor esi, edi
xor dword [ebp - 0x20], 0x3bc4077e
mov dword [edx], esi
sub dword [ebp - 8], eax
add edx, 0x5568198c
sub edx, 0x55681988
add ebx, 4
loop 0x2e01c591
add eax, 0x137170ca
add eax, 0xec8faf4d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x3ff445dd
sub ecx, 0x11f445dd
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x2e01e38c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x2e030a2c
call fcn.2e02e506
lea eax, [ebp - 0x2c]
xor edi, edi
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e01e449
lea eax, [ebp - 0x30]
mov ebx, str.progid
push eax
push edi
push edi
push edi
push ebx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01e440
mov eax, dword [ebp - 0x30]
inc eax
push eax
call fcn.2e01c470
mov esi, eax
pop ecx
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x30]
mov dword [ebp - 4], edi
push eax
push esi
push edi
push edi
push ebx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ebx, ebx
inc ebx
test eax, eax
jne 0x2e01e433
push esi
lea ecx, [ebp - 0x28]
call fcn.2e00d957
push str.IE.HTTP
lea ecx, [ebp - 0x28]
call fcn.2e01c470
test al, al
jne 0x2e01e428
push edi
push str.AppX
lea ecx, [ebp - 0x28]
call fcn.2e01c470
test eax, eax
cmove edi, ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.2e01c470
or dword [ebp - 4], 0xffffffff
push ebx
push esi
call fcn.2e01c470
pop ecx
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, di
call fcn.2e02e4e4
ret
Function at 0x43fa03
Capabilities:
Hash data with crc32

Disassembly:
je 0x43fbf7
jne 0x43fbf7
cmp dword [0x69a7642c], esi
lea edi, [eax + 0xcd0ea8]
cmp dword [0xd0c3a8], ecx
or dword [eax + 0x20], 0x80
mov byte [eax + esi - 1], 0
cmp dword [0xdeb3d8], edi
mov dword [0x112765ac], eax
mov dword [esi], 0xace0bc
movsx eax, word [ebp - reloc.advapi32.dll_RegSetValueA]
push 0xaab9a8
int1
rcr byte [esi], 1
loop 0x43f2e7
sub eax, 0x22a93090
aaa
out 0x83, al
leave
jmp [eax + reloc.advapi32.dll_CreateProcessAsUserA]
movsd dword es:[edi], dword [esi]
add byte [eax + 0x4561b4], bh
mov eax, 0x10d7a2b8
mov edx, 0xb1ced4
push 0xa76714
mov dword [esi], 0x9fb764
push 0x4f0dcc
mov dword [edx + esi + 0x13c], 0x10261f8c
push 0x697a2e6c
mov byte [ebp - 0x132], 0
mov ecx, 0x15
sti
and bh, byte [edi + 0x4232049f]
cmp byte [eax], bl
mov al, byte [0x6b249244]
dec edi
arpl word [eax], bx
cwde
jmp 0x43fa03
not ecx
xor ebx, ebx
je 0x43fafa
jne 0x43fafa
cmp dword [ebp + 0xc], eax
jmp dword [ecx*4 + 0x86d66c]
shr ecx, 8
je 0x43f8c9
jne 0x43f8c9
mov dword [0x112b2da8], eax
neg dword [ebp + 0x12]
push 0xa233fc
push 0x1016adc0
mov dword [0x1124da0c], eax
mov dword [0x111d2de4], eax
cmp dword [ebp + 0x1c], 0x80000000
mov dword [esi], 0xa0e618
pmaddwd xmm6, xmmword [0x69809430]
mov eax, 0x10dab0f8
push 0x100d8c6c
mov ecx, dword [0x42be3c]
movzx eax, word [reloc.advapi32.dll_RegSetValueA]
add ebp, 0x518
mov dword [esi + 0x5c], 0x42edc0
push 0xaf4520
cmp byte [0xdef019], 0
mov dword [esp + 0xec], 0x1028d9a4
hlt
mov dword [ebp - 0x128], ebx
mov dword [ebp - 4], 0xfffffffe
push 0x43fb85
ret
push eax
push 0x43fe3a
ret
je 0x43f33b
movzx eax, byte [esi]
xor eax, ecx
je 0x43fd59
jne 0x43fd59
mov ecx, dword [0x1152b260]
lock cmpxchg dword [ebx], edx
mov dword [esi + 0x694], 1
mov dword [esi + 4], 0x63eba0
jmp dword [0x49140c]
xor ecx, dword [eax*4 + 0x401240]
push 0x43f5f1
ret
mov eax, edx
dec edx
mov dword [ebp - 0x130], edx
test eax, eax
jmp 0x43f814
mov dword [ebp - 0x124], esi
jmp 0x43f925
cmp ecx, 0x39b5d60d
sete bl
jmp 0x43f464
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4b19b0
push 0x4a41c0
mov eax, dword fs:[0]
jmp 0x43f67a
and eax, 0xff
jmp 0x43f37a