joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4752bc
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x475467
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x475448
mov dl, 1
mov eax, dword [0x41b33c]
call fcn.00403440
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404288
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x475437
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00462514
test al, al
je 0x47542a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x475478
lea eax, [ebp - 0x254]
call fcn.00409994
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x47542a
xor eax, eax
push ebp
push 0x475423
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x4754b0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x47540c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004044f8
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x47540c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004044f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47542a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x47532d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041fc88
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47546e
lea eax, [ebp - 0x260]
call fcn.00404288
ret

Function at 0x475de4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x518bf4]
cmp byte [eax + 0xa5], 0
jne 0x475e55
cmp dword [0x518c0c], 0
jne 0x475e16
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x475da0
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x518c0c], eax
cmp dword [0x518c08], 0
jne 0x475e31
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x518c08], eax
cmp dword [0x518c10], 0
jne 0x475e55
push esp
push 0
push 0
push 0x475d44
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x518c10], eax
pop edx
ret
Function at 0x475fa8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x475fbf
add esp, 0xfffffff0
call fcn.004037d4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00425c88
mov eax, dword [0x516b5c]
cmp word [eax + 2], 0
jne 0x475fe7
mov eax, dword [0x516b5c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004775a4
mov eax, dword [0x516cdc]
cmp word [eax + 2], 0
jne 0x476001
mov eax, dword [0x516cdc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0047779c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41ac64]
call fcn.00403440
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41ac64]
call fcn.00403440
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x4283ac]
call fcn.0042fdf4
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x476188
mov eax, dword [0x516954]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004301c4
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x477d3c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x516954]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d8d0
test eax, eax
je 0x4760f6
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00409358
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d8f8
test eax, eax
je 0x47610a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004044f8
mov eax, dword [0x5166a8]
cmp byte [eax], 0
jne 0x47613e
mov eax, ebx
call fcn.004762b0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00477f18
mov eax, ebx
call fcn.004788dc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x47617e
call fcn.0040382c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x476530
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x518bf4]
cmp dword [eax + 0x30], 0
je 0x4765da
cmp dword [ebx + 0x94], 0
jne 0x4765d4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4764c0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4765d4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x47659a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4765d4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041d5a4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4765a9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x47713c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x477171
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404378
jmp 0x47717e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004042dc
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4780f4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x478135
mov eax, esi
call fcn.0045da8c
test al, al
je 0x478135
mov eax, dword [ebx + 0x84]
call fcn.0045d788
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x478135
push 0
mov eax, dword [ebx + 0x84]
call fcn.0045d788
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x4922b3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x515e8a
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x49230b
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x515eab
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x492301
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x49230f
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x492ec4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x492f58
push 0
mov eax, ebx
call fcn.00404748
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x492f33
mov eax, esi
call fcn.00404548
inc eax
push eax
mov eax, esi
call fcn.00404748
push eax
push 1
push 0
mov eax, edi
call fcn.00404748
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x492f4e
mov ecx, dword [0x516950]
mov dl, 1
mov eax, dword [0x492c30]
call fcn.0040cab4
call fcn.00403c3c
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x4b462c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b488c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4b468f
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004b40f4
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d3fc
cmp al, 1
jne 0x4b468f
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004b440c
test al, al
je 0x4b481b
cmp dword [ebp - 8], 0
jge 0x4b46ad
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004b40f4
mov eax, dword [ebp - 0x210]
call fcn.00404548
cmp ebx, eax
jge 0x4b46f7
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004b40f4
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x516fbc]
and eax, 0xff
bt dword [edx], eax
jae 0x4b46f7
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4b470b
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004b4608
cmp ebx, dword [ebp - 8]
je 0x4b480d
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4b4737
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040366c
and eax, 0x7f
movzx eax, word [eax*2 + 0x5162a0]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4b47fa
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040366c
and eax, 0x7f
movzx eax, word [eax*2 + 0x5162a0]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0045d788
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040366c
and eax, 0x7f
movzx eax, word [eax*2 + 0x5162a0]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0045d788
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4801
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4b486e
cmp dword [ebp - 8], 0
jge 0x4b4826
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004b40f4
mov eax, dword [ebp - 0x218]
call fcn.00404548
cmp eax, dword [ebp - 8]
jg 0x4b4860
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004b40f4
mov eax, dword [ebp - 0x21c]
call fcn.00404548
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004b4608
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4893
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004042ac
ret
Function at 0x4cdb2c
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
push esp
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0x14]
shr eax, 1
add eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x4d2048
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffffef0
mov ebx, eax
push esp
push 0x20019
push 0
push 0x4d2114
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4d210a
mov dword [esp + 4], 0x105
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x4d2138
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4d2101
mov eax, ebx
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.004044f8
mov edx, dword [ebx]
mov eax, 0x4d2148
call fcn.0040488c
test eax, eax
jle 0x4d20d5
push ebx
mov edx, dword [ebx]
mov eax, 0x4d2148
call fcn.0040488c
mov ecx, eax
dec ecx
mov eax, dword [ebx]
mov edx, 1
call fcn.004047a8
mov eax, dword [ebx]
call fcn.00404548
cmp eax, 2
jle 0x4d2101
mov eax, dword [ebx]
call fcn.00404548
mov edx, eax
mov eax, dword [ebx]
call fcn.0040d6ac
test al, al
jne 0x4d2101
mov eax, ebx
mov edx, 0x4d2154
call fcn.00404550
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
add esp, 0x110
pop ebx
ret

Function at 0x50cba8
Capabilities:
Log keystrokes via polling

Disassembly:
push 2
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x50cbc9
push 1
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x50cbc9
xor eax, eax
ret
mov al, 1
ret
Function at 0x51112c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x511302
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0x38], 0
jne 0x5112e9
mov eax, dword [edi + 0x30]
call fcn.00404548
test eax, eax
jne 0x511182
mov eax, dword [edi + 0x34]
call fcn.00404548
test eax, eax
jne 0x511182
mov eax, edi
call fcn.005113a0
jmp 0x5112e9
cmp dword [edi + 0xa0], 0
jne 0x5111b9
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x30]
call fcn.004093b4
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x518e20]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa0], eax
cmp dword [edi + 0xa4], 0
jne 0x5111f0
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x34]
call fcn.004093b4
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x518e20]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa4], eax
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.005113e0
mov ebx, eax
test bl, bl
jne 0x51129e
mov eax, dword [edi + 0x30]
call fcn.00404548
test eax, eax
jne 0x511228
mov eax, dword [edi + 0xc0]
call fcn.00404548
test eax, eax
je 0x51129e
mov eax, dword [edi + 0xc0]
call fcn.00404548
test eax, eax
je 0x51124a
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0xc0]
call fcn.004093b4
jmp 0x511276
push dword [edi + 0x30]
push 0x51131c
push dword [edi + 0x34]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00404608
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.004093b4
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x51129e
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.005113e0
mov ebx, eax
test bl, bl
jne 0x5112ab
mov eax, edi
call fcn.005113a0
jmp 0x5112e9
mov eax, dword [edi + 0x58]
test eax, eax
je 0x5112ba
mov dword [edi + 0xa8], eax
jmp 0x5112c4
mov dword [edi + 0xa8], 1
mov eax, edi
call fcn.00511458
test al, al
je 0x5112e9
mov eax, edi
mov si, 0xffee
call fcn.0040366c
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.00511504
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511309
lea eax, [ebp - 0x108]
call fcn.00404288
ret
Function at 0x420ab0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x16000]
push edi
or ebp, 0xffffffff
jmp 0x420ad2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x420ad9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x420ac8
mov eax, 1
add ebx, ebx
jne 0x420aeb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x420ae0
jne 0x420afc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x420ae0
xor ecx, ecx
sub eax, 3
jb 0x420b10
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x420b82
mov ebp, eax
add ebx, ebx
jne 0x420b1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x420b28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x420b4c
inc ecx
add ebx, ebx
jne 0x420b38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x420b2d
jne 0x420b49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x420b2d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x420b6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x420b5d
jmp 0x420ace
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x420b6c
add edi, ecx
jmp 0x420ace
pop esi
mov edi, esi
mov ecx, 0x972
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x420b8a
cmp byte [edi], 6
jne 0x420b8a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x420b8f
lea edi, [esi + 0x1e000]
mov eax, dword [edi]
or eax, eax
je 0x420bfe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x228ac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x22924]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x420bbc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x22928]
or eax, eax
je 0x420bf8
mov dword [ebx], eax
add ebx, 4
jmp 0x420bd9
call dword [esi + 0x22930]
mov ebp, dword [esi + 0x2292c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x420c32
sub esp, 0xffffff80
jmp 0x413754
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5f2a08fb
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4f261f79
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x403f00
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push 0xf0000000
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x403f25
xor al, al
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x94
push 0x42bba0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x403f1f
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x403f1f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x403f1f
push ebx
push 0
push 0
push dword [ebp - 0xc]
xor bl, bl
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptVerifySignatureA]
test eax, eax
movzx ebx, bl
mov eax, dword [ebp - 4]
mov ecx, 1
cmovne ebx, ecx
test eax, eax
je 0x403fa7
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x403fb7
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403fc0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push str.C:WINDOWS_system32_rdpqpd.xsl
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x403ff5
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ebx
mov dword [ebp - 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov esi, dword [ebp - 0x14]
push esi
push 0x40
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
test eax, eax
jne 0x404036
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [ebp + 8]
mov eax, esi
mov dword [edi], 0
test eax, eax
jle 0x40407c
nop word [eax + eax]
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push esi
push dword [ecx]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 8]
test eax, eax
je 0x404079
add dword [edi], eax
sub esi, eax
mov ecx, dword [ebp - 4]
test esi, esi
jg 0x404050
mov eax, dword [ebp - 0xc]
cmp dword [edi], eax
pop edi
push ebx
je 0x40409b
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
push dword [edx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret