joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65194
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.000140a4
xor eax, eax
push ebp
push 0x6529d
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.00064778
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x65263
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00018a18
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00065a3c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.000188f4
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00065ab0
jmp 0x65275
xor edx, edx
mov eax, ebx
call fcn.00065a3c
xor edx, edx
mov eax, ebx
call fcn.00065ab0
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x652a4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00013c94
ret

Function at 0x6b7e4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x160]
mov edx, ebx
mov eax, edi
call fcn.0006ba18
mov esi, eax
mov dword [edi + 0x160], esi
and esi, 0xff
add dword [edi + 0x164], esi
imul esi, dword [edi + 0x164], 0x8088405
inc esi
mov dword [edi + 0x164], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x168]
mov eax, edi
call fcn.0006ba18
mov dword [edi + 0x168], eax
pop edi
pop esi
pop ebx
ret

Function at 0x6b858
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x6b87d
inc esi
mov eax, edi
call fcn.0006b83c
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.0006b7e4
inc ebx
dec esi
jne 0x6b867
pop edi
pop esi
pop ebx
ret
Function at 0x6b90c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.000140a4
xor eax, eax
push ebp
push 0x6b981
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0006b884
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.0006b83c
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.0006b7e4
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x6b94c
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b988
lea eax, [ebp - 4]
call fcn.00013c70
ret
Function at 0x6c564
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6c748
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x6c704
mov eax, dword [ebp - 4]
call fcn.0006e0d0
cmp ebx, eax
jge 0x6c704
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x108]
mov edx, ebx
call fcn.0006308c
mov edx, dword [0x64b34]
call fcn.0001315c
mov esi, eax
mov eax, esi
call fcn.000659d0
test al, al
je 0x6c6fa
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x6c6ee
xor eax, eax
push ebp
push 0x6c6e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0006cd3c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x120]
call fcn.000621c8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x120]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xc]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x120]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 4]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x120]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0xc]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00014224
mov eax, dword [ebp - 8]
call fcn.000140c0
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x120]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x148]
mov al, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0006c8e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x148]
mov dl, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c732
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x120]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x6c6e6
mov eax, dword [ebp - 4]
call fcn.0006cdc0
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00018dd0
jmp 0x6c732
mov eax, dword [ebp - 8]
call fcn.00013c70
jmp 0x6c732
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.00018440
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x1ce50]
call fcn.00019f28
call fcn.00013724
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c74f
lea eax, [ebp - 0x54]
call fcn.00013c70
ret
Function at 0x73034
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.000140a4
xor eax, eax
push ebp
push 0x730bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00013c70
push 0xff
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0xff
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 4]
call fcn.000140b4
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x730a9
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
mov edx, ebx
mov eax, 8
call fcn.0001835c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x730c6
lea eax, [ebp - 4]
call fcn.00013c70
ret

Function at 0x73980
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffff54
mov ebx, eax
mov dword [esp + 8], 0x94
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x18], 2
jne 0x73a06
push esp
push 0x28
call fcn.000165fc
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 0xa0]
push eax
push 0x73a10
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 0x9c], 1
test bl, bl
je 0x739e0
mov dword [esp + 0xa8], 2
jmp 0x739e9
xor eax, eax
mov dword [esp + 0xa8], eax
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0xa8]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
add esp, 0xac
pop ebx
ret
Function at 0x73fe4
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x73fed
mov eax, dword [ebp - 4]
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
push 0
push 0
push 0
push 0
push 0x74128
call fcn.00057a48
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x74121
xor edx, edx
push ebp
push 0x7411a
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x80000000
push 0
push 0
mov eax, esi
call fcn.000140b4
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00057a50
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x74103
xor edx, edx
push ebp
push 0x740fc
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], sym.MZP_IGyRM_IFIBLEj___hfdbYa_A_T.mNOcDx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x10014]
push eax
push 0x16
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_HttpQueryInfoA
neg eax
sbb eax, eax
neg eax
test al, al
je 0x740e5
lea edx, [ebp - 0x10014]
mov ecx, sym.MZP_IGyRM_IFIBLEj___hfdbYa_A_T.mNOcDx
mov eax, edi
mov esi, dword [eax]
call dword [esi + 8]
lea eax, [ebp - 0xc]
push eax
push 0x3e8
lea eax, [ebp - 0x10014]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
je 0x740e5
cmp dword [ebp - 0xc], 0
je 0x740df
lea edx, [ebp - 0x10014]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 8]
cmp dword [ebp - 0xc], 0
jne 0x740ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x74103
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x74121
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xc0bb90
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0xc0bc9c
test eax, eax
je 0xc0bc9c
push esi
push edi
mov ecx, 0x10
mov esi, 0xc25fe0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0xc0bc83
lea edi, [eax + 4]
jmp 0xc0bbe7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0xc0bbfc
mov dword [ebp - 4], 2
jmp 0xc0bc1d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0xc0bc13
mov dword [ebp - 4], 1
jmp 0xc0bc1d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0xc0bc93
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0xc0bc56
mov byte [ecx], 0x3d
jmp 0xc0bc62
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0xc0bc6d
mov byte [ecx], 0x3d
jmp 0xc0bc73
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0xc0bbe4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xc0f6b0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov esi, eax
mov ebx, ecx
jne 0xc0f6d9
push esi
call fcn.00c0f020
test al, al
jne 0xc0f6d9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x48]
push eax
push ecx
call fcn.00c09800
mov edi, eax
call fcn.00c09bc0
mov edi, eax
add esp, 4
mov eax, 0x40
call fcn.00c0d5f0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc0]
push edx
push eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 4], 0x40
call fcn.00c0bb90
mov ecx, dword [ebp - 4]
add esp, 0x10
xor eax, eax
push 4
lea edx, [ebp - 4]
push edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x7c], eax
mov byte [ebp - 0x80], al
push 0x10
mov eax, esi
mov byte [ebp + ecx - 0xc0], 0
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
mov dword [ebp - 0x20], 0xc3d2e1f0
call fcn.00c0b8d0
test al, al
je 0xc0f76c
mov edi, dword [ebp - 4]
jmp 0xc0f76f
or edi, 0xffffffff
push 4
lea eax, [ebp - 4]
push eax
push 0xc
mov eax, esi
call fcn.00c0b8d0
test al, al
je 0xc0f787
mov eax, dword [ebp - 4]
jmp 0xc0f78a
or eax, 0xffffffff
push edi
push eax
push esi
lea esi, [ebp - 0x80]
call fcn.00c0be10
cmp byte [ebp - 0x80], 0
mov dword [ebp - 4], 0x40
jne 0xc0f7ab
call fcn.00c0c340
mov byte [ebp - 0x80], 1
xor eax, eax
lea ecx, [ecx]
mov ecx, dword [ebp + eax*4 - 0x30]
bswap ecx
mov dword [ebp + eax*4 - 0x1c], ecx
inc eax
cmp eax, 5
jb 0xc0f7b0
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x1c]
push 0x14
push ecx
call fcn.00c0bb90
mov edx, dword [ebp - 4]
add esp, 0x10
cmp byte [ebp + 0xc], 0
mov byte [ebp + edx - 0x100], 0
mov eax, 0xc26344
jne 0xc0f7f4
mov eax, 0xc2635c
push 0
push eax
mov edi, ebx
call fcn.00c0f530
mov eax, dword [ebp + 8]
push 1
push eax
call fcn.00c0f530
push 0
push 0xc26374
call fcn.00c0f530
push 1
lea ecx, [ebp - 0xc0]
push ecx
call fcn.00c0f530
push 0
push 0xc2637c
call fcn.00c0f530
push 1
lea edx, [ebp - 0x100]
push edx
call fcn.00c0f530
cmp byte [ebp + 0xc], 0
je 0xc0f848
call fcn.00c0f610
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xc0fa50
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
jne 0xc0fa6f
mov ebx, dword [ebp + 8]
push eax
call fcn.00c0f020
test al, al
je 0xc0faa9
mov ebx, dword [ebp + 0xc]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xc0fa77
sub eax, edx
mov esi, eax
push esi
mov dword [ebp + 0xc], esi
call fcn.00c16cc4
lea ecx, [ebp + 0xc]
push ecx
mov edi, eax
push edi
push esi
push ebx
call fcn.00c0bcb0
add esp, 0x14
test al, al
jne 0xc0fab4
push edi
call fcn.00c173b7
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
xor ebx, ebx
push edx
push edi
lea esi, [ebp - 0x7c]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x2c], 0x67452301
mov dword [ebp - 0x28], 0xefcdab89
mov dword [ebp - 0x24], 0x98badcfe
mov dword [ebp - 0x20], 0x10325476
mov dword [ebp - 0x1c], 0xc3d2e1f0
mov byte [ebp - 0x7c], bl
call fcn.00c0bdc0
mov dword [ebp + 0xc], 0x40
cmp byte [ebp - 0x7c], bl
jne 0xc0fb07
call fcn.00c0c340
mov byte [ebp - 0x7c], 1
xor eax, eax
lea esp, [esp]
mov ecx, dword [ebp + eax*4 - 0x2c]
bswap ecx
mov dword [ebp + eax*4 - 0x18], ecx
inc eax
cmp eax, 5
jb 0xc0fb10
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x18]
push 0x14
push ecx
call fcn.00c0bb90
mov edx, dword [ebp + 0xc]
push edi
mov byte [ebp + edx - 0xbc], bl
call fcn.00c173b7
mov bl, byte [ebp + 0x10]
add esp, 0x14
mov eax, 0xc263a0
test bl, bl
jne 0xc0fb5a
mov eax, 0xc263b8
mov edi, dword [ebp + 8]
push 0
push eax
call fcn.00c0f530
push 1
lea eax, [ebp - 0xbc]
push eax
call fcn.00c0f530
test bl, bl
je 0xc0fb7c
call fcn.00c0f610
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0xc7c035
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0xc8f453
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
jmp 0xd1536a
sysenter
ret

Function at 0xce58af
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40596d
pop dword [ebp - 0x1c]
mov eax, 0x7b34965
add eax, 0xf88d1008
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x38454871
sub dword [ebp - 0x2c], 0xe9f30326
mov dword [ebp - 0x28], 0xe08aa8a4
add dword [ebp - 0x28], 0x51a8a3a1
mov dword [ebp - 0x24], 0xc946a31
add dword [ebp - 0x24], 0x3fb7d9fd
mov dword [ebp - 0x20], 0x9a59db4b
add dword [ebp - 0x20], 0x65a624b5
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x7edfff10
add eax, 0x81607150
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x405502a4
sub dword [ebp - 0x2c], 0xcbe2994e
mov dword [ebp - 0x28], 0x9695be15
add dword [ebp - 0x28], 0xaad6a360
mov dword [ebp - 0x24], 0xa6bce677
add dword [ebp - 0x24], 0xbcb285f5
mov dword [ebp - 0x20], 0xecf860a5
add dword [ebp - 0x20], 0x13079f5b
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x38893
push 0
call eax
mov ecx, 0x4f47
mov edi, eax
mov esi, 0xb5a8c6bb
add esi, 0x4a983945
add esi, dword [ebp - 0x1c]
mov ebx, 0xce38f01b
sub ebx, 0x169eae09
add dword [ebp - 0xc], eax
mov edx, dword [esi]
mov dword [ebp - 0x14], 0x3900878f
add edx, ebx
mov dword [ebp - 4], 0xee38b63a
mov dword [edi], edx
xor dword [ebp - 0x14], edi
add edi, 0x41dc4844
sub edi, 0x41dc4840
add esi, 0x81081a69
sub esi, 0x81081a65
loop 0x405a84
add eax, 0x5a4ada6
sub eax, 0x5a37db7
xor ebx, ebx
add ebx, eax
add eax, 0x98b10b55
sub eax, 0x98b10b50
mov ecx, 0x3d57ff6d
add ecx, 0xc2e80093
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x45f9ea
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x486904]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0045f97f
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00446ce0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x45fa39
cmp dword [ebp - 0x1c], 5
jb 0x45fa51
jmp 0x45fa4d
cmp dword [ebp - 0x10], 1
jne 0x45fa51
cmp dword [ebp - 0x1c], 4
ja 0x45fa4d
jne 0x45fa51
cmp dword [ebp - 0x18], 0
jbe 0x45fa51
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x475d5c
call fcn.0045f870
test eax, eax
jge 0x45fa72
mov byte [0x49381c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00445fb9
add ebp, 0x78
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x287a2703
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
mov ecx, 0x4c143802
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40301c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x403028
push 0x403024
push 0x403020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x403028]
push dword [0x403024]
push dword [0x403020]
mov dword [0x403014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x401460
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4014b9
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x40149d
cmp eax, 2
jne 0x4014ac
test esi, esi
mov eax, dword [esp]
je 0x4014b5
mov cl, byte [eax + esi - 1]
test cl, cl
je 0x4014b5
mov eax, 0xd
pop ecx
ret 8
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8

Function at 0x401600
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42b178
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 0x10]
mov edx, dword [ecx]
push edi
xor edi, edi
mov dword [esp + 8], edi
call dword [edx + 0x10]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], edi
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
mov ecx, dword [esi]
mov esi, dword [ecx - 0xc]
push edx
push eax
push esi
push ecx
lea ecx, [esp + 0x30]
push ecx
call fcn.004018c0
mov esi, dword [esp + 0x34]
add esi, 0xfffffff0
push esi
call fcn.00401d60
mov edi, dword [esp + 0x34]
add eax, 0x10
mov dword [edi], eax
add esp, 0x18
mov dword [esp + 0x14], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x401692
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x401fd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401fe9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x401ffd
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40201e
cmp esi, eax
jae 0x401ff7
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402010
cmp esi, eax
jae 0x401ff7
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret