joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e5b
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x402e78
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov ebx, edi
test edi, edi
jne 0x402e87
mov ebx, str.BM_bl
mov eax, dword [ebp + 8]
test eax, eax
jl 0x402e9c
mov ecx, dword [0x423ed8]
add ecx, eax
push ecx
call fcn.00403080
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.0040304e
test eax, eax
je 0x402ff9
test byte [ebp + 0x17], 0x80
je 0x402fe2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40af90
mov dword [ebp - 0xc], eax
call fcn.00405dd9
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x403044
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x402eec
mov esi, dword [ebp + 0x14]
mov edi, 0x40b020
push esi
push edi
call fcn.0040304e
test eax, eax
je 0x402ff9
sub dword [ebp + 0x14], esi
mov dword [0x40afa8], edi
mov dword [0x40afac], esi
mov eax, dword [ebp - 8]
mov ecx, 0x40af90
mov dword [str.BM_bl], ebx
mov dword [0x40afb4], eax
call fcn.00405df9
test eax, eax
mov dword [ebp - 0x14], eax
jl 0x402fda
mov esi, dword [str.BM_bl]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x423f34], 1
mov edi, eax
je 0x402f8e
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x402f5b
cmp dword [ebp + 0x14], 0
jne 0x402f8e
mov eax, dword [ebp + 8]
push dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x54]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push 0
call fcn.00404d7b
mov dword [ebp - 0xc], edi
xor eax, eax
cmp esi, eax
je 0x402fcf
cmp dword [ebp + 0x10], eax
jne 0x402fb7
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402fde
cmp dword [ebp - 0x10], esi
jne 0x402fde
add dword [ebp - 4], esi
jmp 0x402fc3
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov ebx, dword [str.BM_bl]
cmp dword [ebp - 0x14], 1
jne 0x402f0f
jmp 0x403044
cmp dword [ebp + 0x14], eax
jg 0x402edf
jmp 0x403044
push 0xfffffffffffffffc
jmp 0x402ffb
push 0xfffffffffffffffe
jmp 0x402ffb
test edi, edi
je 0x403039
cmp dword [ebp + 0x14], esi
jge 0x402fee
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.0040304e
test eax, eax
jne 0x403041
push 0xfffffffffffffffd
pop eax
jmp 0x403047
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x403009
mov esi, dword [ebp + 0x14]
mov edi, 0x40b020
push esi
push edi
call fcn.0040304e
test eax, eax
je 0x402ff9
lea eax, [ebp + 0x10]
push 0
push eax
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402fde
cmp esi, dword [ebp + 0x10]
jne 0x402fde
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x402ffe
jmp 0x403044
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4055b1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, str.C:UsersADMINI1AppDataLocalTemp_nsx76B2.tmp
push esi
call fcn.004059dd
push esi
call fcn.00405564
mov edi, eax
test edi, edi
jne 0x4055d2
xor eax, eax
jmp 0x405624
push edi
call fcn.00405c3f
test byte [0x423e98], 0x80
je 0x4055eb
mov al, byte [edi]
test al, al
je 0x4055ce
cmp al, 0x5c
je 0x4055ce
sub edi, esi
jmp 0x405603
call fcn.00405cd8
test eax, eax
je 0x4055fd
test byte [eax], 0x10
je 0x4055ce
push esi
call fcn.00405517
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x4055ef
call fcn.004054d0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405695
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4056b1
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x4056b4
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4056e3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405727
test edi, edi
jne 0x4056ee
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405721
Function at 0x410686
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x44a1f8]
test esi, esi
jne 0x4106a4
mov ecx, 0x44a1f0
call fcn.00410611
mov esi, dword [0x44a1f8]
mov eax, dword [ebp + 0xc]
movzx ecx, byte [ebp + 0x14]
and eax, 0xfffffff0
cmp byte [ebp + 0x10], 0
je 0x4106ef
test esi, esi
je 0x410713
push ecx
push eax
push dword [ebp + 8]
mov ecx, esi
call dword [0x434278]
call esi
test eax, eax
jne 0x410737
push str.CryptProtectMemory_failed
mov esi, 0x4430c4
push esi
call fcn.004076c9
pop ecx
pop ecx
mov ecx, esi
call fcn.00407851
push 2
mov ecx, esi
call fcn.004076c4
jmp 0x410737
mov esi, dword [0x44a1fc]
test esi, esi
je 0x410713
push ecx
push eax
push dword [ebp + 8]
mov ecx, esi
call dword [0x434278]
call esi
test eax, eax
jne 0x410737
push str.CryptUnprotectMemory_failed
jmp 0x4106d0
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ebx, eax
cmp dword [ebp + 0xc], edx
jbe 0x410736
mov esi, dword [ebp + 8]
lea eax, [ebx + 0x4b]
add al, dl
lea ecx, [edx + esi]
xor byte [ecx], al
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x410726
pop ebx
pop esi
pop ebp
ret 0x10

Function at 0x411346
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret 4
Function at 0x401452
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00409720
mov eax, dword [0x244fc5c]
mov ecx, dword [0x244f6e8]
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x40150a
push ebx
push edi
mov ebx, ecx
mov edi, eax
cmp dword [0x244fc5c], 0x959
jne 0x4014f9
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push str.Mokigehate_xolega_viricuh_mazu_fiboy
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push str.Yimu_givexohipalipen
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push str.Hipejes_joh_jagibavicedok_lozofowegad_dinomebaxedidox
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push esi
lea eax, [ebp - 0x1000]
push eax
push esi
push str.pajebipew
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00401061
add ebx, 8
dec edi
jne 0x40147e
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4017d7
Capabilities:
Clear file content
Get common file path

Disassembly:
sub esp, 0x800
push esi
xor esi, esi
cmp dword [0x244fc5c], 0x400
push edi
jne 0x401837
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateW]
push esi
call fcn.004027e7
push esi
call fcn.00402671
push esi
push esi
call fcn.004027a7
push esi
call fcn.00402ebd
push esi
push esi
call fcn.00402d08
push esi
call fcn.00402f73
push esi
push esi
call fcn.004026ab
add esp, 0x28
xor edi, edi
cmp edi, 0x16c76
jge 0x401849
push esi
push esi
call dword [sym.imp.USER32.dll_SetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0x12e5c52
jg 0x40186f
inc edi
cmp edi, 0x3003f
jl 0x401839
mov eax, dword [0x43269c]
mov dword [0x244fc5c], eax
call fcn.0040150d
mov edi, 0x3078f
cmp dword [0x244fc5c], 0x51f
jne 0x40189b
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec edi
jne 0x401883
pop edi
xor eax, eax
pop esi
add esp, 0x800
ret 0x10

Function at 0x404dbf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431824]
jne 0x404dc9
repz ret
jmp fcn.0040830c
Function at 0x4093b2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x431824]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403d1e
and dword [ebp - 0x14], 0
cmp dword [0x43d510], 0
mov dword [ebp - 0x18], eax
jne 0x409465
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40950d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40950d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x43d510], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x43d514], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x43d518], eax
call edi
push eax
call esi
mov dword [0x43d520], eax
test eax, eax
je 0x409465
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x43d51c], eax
mov eax, dword [0x43d51c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4094be
cmp dword [0x43d520], ecx
je 0x4094be
push eax
call esi
push dword [0x43d520]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4094be
test ebx, ebx
je 0x4094be
call edi
test eax, eax
je 0x4094b5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4094b5
test byte [ebp - 8], 1
jne 0x4094be
or dword [ebp + 0x10], 0x200000
jmp 0x4094f1
mov eax, dword [0x43d514]
cmp eax, dword [ebp - 0x18]
je 0x4094f1
push eax
call esi
test eax, eax
je 0x4094f1
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4094f1
mov eax, dword [0x43d518]
cmp eax, dword [ebp - 0x18]
je 0x4094f1
push eax
call esi
test eax, eax
je 0x4094f1
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43d510]
call esi
test eax, eax
je 0x40950d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40950f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404dbf
leave
ret
Function at 0x401e1e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x4a4fec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x4800b8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], eax
mov eax, 0x47fd28
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
push eax
push 0x4a93b8
push 0x47fce4
lea eax, [ebp - 0xcc]
push 0x18
push eax
mov dword [ebp - 0xcc], 0x4800ac
mov dword [ebp - 0xc8], 0x480094
mov dword [ebp - 0xc4], 0x48008c
mov dword [ebp - 0xc0], 0x480078
mov dword [ebp - 0xbc], 0x480070
mov dword [ebp - 0xb8], 0x48005c
mov dword [ebp - 0xb4], 0x480054
mov dword [ebp - 0xb0], 0x48003c
mov dword [ebp - 0xac], 0x480038
mov dword [ebp - 0xa8], 0x480028
mov dword [ebp - 0xa4], 0x48001c
mov dword [ebp - 0xa0], 0x480004
mov dword [ebp - 0x9c], 0x47fff8
mov dword [ebp - 0x98], 0x47ffe0
mov dword [ebp - 0x94], 0x47ffd4
mov dword [ebp - 0x90], 0x47ffb8
mov dword [ebp - 0x8c], 0x47ffac
mov dword [ebp - 0x88], 0x47ff94
mov dword [ebp - 0x84], 0x47ff84
mov dword [ebp - 0x80], 0x47ff68
mov dword [ebp - 0x7c], 0x47ff54
mov dword [ebp - 0x78], 0x47ff3c
mov dword [ebp - 0x74], 0x47ff2c
mov dword [ebp - 0x70], 0x47ff10
mov dword [ebp - 0x6c], 0x47ff00
mov dword [ebp - 0x68], 0x47fee4
mov dword [ebp - 0x64], 0x47fed0
mov dword [ebp - 0x60], 0x47feb0
mov dword [ebp - 0x5c], 0x47fea4
mov dword [ebp - 0x58], 0x47fe8c
mov dword [ebp - 0x54], 0x47fe74
mov dword [ebp - 0x50], 0x47fe50
mov dword [ebp - 0x4c], 0x47fe40
mov dword [ebp - 0x44], 0x47fe2c
mov dword [ebp - 0x3c], 0x47fe20
mov dword [ebp - 0x38], 0x47fe08
mov dword [ebp - 0x34], 0x47fdf8
mov dword [ebp - 0x30], 0x47fddc
mov dword [ebp - 0x2c], 0x47fdcc
mov dword [ebp - 0x28], 0x47fdb0
mov dword [ebp - 0x24], 0x47fda4
mov dword [ebp - 0x20], 0x47fd8c
mov dword [ebp - 0x1c], 0x47fd80
mov dword [ebp - 0x18], 0x47fd68
mov dword [ebp - 0x14], 0x47fd5c
mov dword [ebp - 0x10], 0x47fd44
call fcn.00401da4
mov ecx, dword [ebp - 4]
add esp, 0x14
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0043cac0
leave
ret
Function at 0x412417
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using xor
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.004123d8
lea ecx, [eax + 0x94]
call fcn.00410183
call fcn.004123d8
mov ecx, eax
pop ebp
jmp fcn.00410715

Function at 0x41689e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x840
mov eax, dword [0x4a4fec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x823
lea eax, [ebp - 0x837]
mov esi, ecx
mov edi, edx
push ebx
push eax
mov dword [ebp - 0x840], esi
mov dword [ebp - 0x83c], edi
mov byte [ebp - 0x838], bl
call fcn.0043cad0
add esp, 0xc
cmp esi, ebx
je 0x416993
cmp dword [ebp + 8], ebx
je 0x416993
cmp edi, ebx
je 0x416993
push edi
mov edi, dword [0x47f240]
lea eax, [ebp - 0x838]
push 0x824
push eax
call edi
add esp, 0xc
test eax, eax
jne 0x416993
mov dword [ebp - 0x14], 0x23223e3c
mov dword [ebp - 0x10], 0x5c7c7d7b
mov dword [ebp - 0xc], 0x275d5b5e
mov byte [ebp - 8], 0x20
xor esi, esi
movsx eax, byte [ebp + esi - 0x14]
push eax
push dword [ebp - 0x83c]
call dword [0x47f244]
pop ecx
pop ecx
test eax, eax
jne 0x41694f
inc esi
cmp esi, 0xd
jl 0x416931
cmp esi, 0xd
je 0x416975
push 0x60001000
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x840]
push dword [ebp - 0x83c]
call dword [0x47f3a4]
test eax, eax
js 0x41698f
jmp 0x41698d
push dword [ebp - 0x83c]
push dword [ebp + 8]
push dword [ebp - 0x840]
call edi
add esp, 0xc
test eax, eax
jne 0x41698f
mov bl, 1
mov al, bl
jmp 0x416995
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043cac0
leave
ret

Function at 0x41a73f
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret
Function at 0x41b81b
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x4a3ca8]
push edi
mov edi, eax
mov eax, dword [ebp + 8]
mov ebx, ecx
cmp eax, 3
jb 0x41b88d
push 3
xor edx, edx
pop ecx
div ecx
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x12
movzx ecx, byte [eax + ebx]
mov edx, dword [ebp - 4]
shl edx, 8
or ecx, edx
inc eax
mov dword [ebp - 4], ecx
cmp eax, 3
jl 0x41b84c
xor edx, edx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
sub dword [ebp - 8], 6
shr eax, cl
and eax, 0x3f
mov al, byte [eax + esi]
mov byte [edx + edi], al
inc edx
cmp edx, 4
jl 0x41b863
sub dword [ebp + 8], 3
add ebx, 3
add edi, 4
dec dword [ebp - 0xc]
jne 0x41b840
mov eax, dword [ebp + 8]
dec eax
je 0x41b8cc
dec eax
jne 0x41b8eb
movzx eax, byte [ebx]
shr eax, 2
mov al, byte [eax + esi]
mov byte [edi], al
movzx eax, byte [ebx]
movzx ecx, byte [ebx + 1]
and eax, 3
shl eax, 4
shr ecx, 4
or eax, ecx
mov al, byte [eax + esi]
mov byte [edi + 1], al
movzx eax, byte [ebx + 1]
and eax, 0xf
mov al, byte [esi + eax*4]
mov byte [edi + 2], al
mov byte [edi + 3], 0x3d
jmp 0x41b8eb
movzx eax, byte [ebx]
shr eax, 2
mov al, byte [eax + esi]
mov byte [edi], al
movzx eax, byte [ebx]
and eax, 3
add eax, eax
mov al, byte [esi + eax*8]
mov byte [edi + 1], al
mov word [edi + 2], 0x3d3d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40c190
cmp edx, dword [eax]
je 0x40878b
add eax, 8
inc ecx
cmp eax, 0x40c220
jl 0x40877c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40c190]
jne 0x4088b9
mov eax, dword [0x40cbb0]
cmp eax, 1
je 0x408893
test eax, eax
jne 0x4087bc
cmp dword [0x40c0e4], 1
je 0x408893
cmp edx, 0xfc
je 0x4088b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4087f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00409670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00409490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x408836
lea eax, [ebp - 0x1a4]
push eax
call fcn.00409490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40b45c
push edi
call fcn.00409f00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00409670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00409680
lea eax, [ebp - 0xa0]
push 0x40b43c
push eax
call fcn.00409680
push dword [esi + 0x40c194]
lea eax, [ebp - 0xa0]
push eax
call fcn.00409680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00409e75
add esp, 0x2c
pop edi
jmp 0x4088b9
lea eax, [ebp + 8]
lea esi, [esi + 0x40c194]
push 0
push eax
push dword [esi]
call fcn.00409490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x432001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x1682761e
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x13d96347
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40332b
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, esi
lea eax, [ebp - 4]
and esi, 0x300
push eax
mov eax, esi
and edi, 1
or al, 9
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040695e
xor ebx, ebx
cmp eax, ebx
jne 0x40340e
test byte [ebp + 0x10], 2
je 0x40338c
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 8], ebx
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x4033f3
lea eax, [ebp - 0x214]
push 0x105
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x4033c8
test edi, edi
jne 0x4033f3
push dword [ebp + 0x10]
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 4]
call fcn.0040332b
test eax, eax
jne 0x4033d1
lea eax, [ebp - 0x214]
push 0x105
push eax
push edi
push dword [ebp - 4]
call ebx
test eax, eax
je 0x4033a1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.0040710c
test eax, eax
jne 0x403403
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x40340e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x40340e
push 0
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x403736
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x403756
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov dword [ebp - 0xc], edi
test edi, edi
jne 0x403768
mov dword [ebp - 0xc], 0x424bb8
mov eax, dword [ebp + 8]
test eax, eax
jl 0x40377d
mov ecx, dword [0x438918]
add ecx, eax
push ecx
call fcn.00403967
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.00403951
test eax, eax
je 0x40393f
test byte [ebp + 0x17], 0x80
je 0x4038ea
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
and dword [0x40f51c], 0
and dword [0x40f518], 0
and dword [ebp + 0x14], 0x7fffffff
mov dword [ebp - 0x10], eax
mov eax, 0x410ba0
mov dword [0x40f000], 8
mov dword [0x418ba8], eax
mov dword [0x418ba4], eax
mov eax, dword [ebp + 0x14]
mov dword [0x418ba0], 0x418ba0
mov dword [ebp + 8], eax
jle 0x403947
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x4037f6
mov esi, dword [ebp + 0x14]
mov edi, 0x420bb8
push esi
push edi
call fcn.00403951
test eax, eax
je 0x40393f
sub dword [ebp + 0x14], esi
mov dword [0x40eff0], edi
mov dword [0x40eff4], esi
mov edi, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
push 0x40eff0
mov dword [0x40eff8], edi
mov dword [0x40effc], eax
call fcn.00407267
test eax, eax
mov dword [ebp - 0x14], eax
jl 0x4038e2
mov esi, dword [0x40eff8]
sub esi, edi
call ebx
test byte [0x438974], 1
mov edi, eax
je 0x40389d
sub eax, dword [ebp - 0x10]
cmp eax, 0xc8
ja 0x403864
cmp dword [ebp + 0x14], 0
jne 0x40389d
mov eax, dword [ebp + 8]
push dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x94]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
push 0
call fcn.00405ac5
mov dword [ebp - 0x10], edi
test esi, esi
je 0x4038d6
cmp dword [ebp + 0x10], 0
jne 0x4038bc
push esi
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call fcn.00406693
test eax, eax
je 0x4038e6
add dword [ebp - 4], esi
jmp 0x4038ca
mov eax, dword [0x40eff8]
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], 1
jne 0x403819
jmp 0x403947
cmp dword [ebp + 0x14], 0
jg 0x4037e9
jmp 0x403947
push 0xfffffffffffffffc
jmp 0x403941
push 0xfffffffffffffffe
jmp 0x403941
test edi, edi
jne 0x40392c
cmp dword [ebp + 0x14], edi
jle 0x403947
mov ebx, dword [ebp - 8]
cmp dword [ebp + 0x14], ebx
mov esi, dword [ebp + 0x14]
jl 0x403900
mov esi, ebx
mov edi, 0x420bb8
push esi
push edi
call fcn.00403951
test eax, eax
je 0x40393f
push esi
push edi
push dword [ebp + 0xc]
call fcn.00406693
test eax, eax
je 0x4038e6
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x4038f6
jmp 0x403947
cmp dword [ebp + 0x14], esi
jge 0x403934
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.00403951
test eax, eax
jne 0x403944
push 0xfffffffffffffffd
pop eax
jmp 0x40394a
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10