joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40589b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4058da
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4058da
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4058da
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4058da
cmp dword [ecx + 0x74], 0xe
jbe 0x4058da
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4324b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x23000]
push edi
jmp 0x4324ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4324d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4324c0
mov eax, 1
add ebx, ebx
jne 0x4324e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4324d8
jne 0x4324f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4324d8
xor ecx, ecx
sub eax, 3
jb 0x432508
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43257a
mov ebp, eax
add ebx, ebx
jne 0x432513
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x432520
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x432544
inc ecx
add ebx, ebx
jne 0x432530
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x432525
jne 0x432541
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x432525
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x432564
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x432555
jmp 0x4324c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x432564
add edi, ecx
jmp 0x4324c6
pop esi
lea edi, [esi + 0x30000]
mov eax, dword [edi]
or eax, eax
je 0x4325cc
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x32fcc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x33008]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x432581
mov ecx, edi
jns 0x4325b0
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x33010]
or eax, eax
je 0x4325c6
mov dword [ebx], eax
add ebx, 4
jmp 0x43259e
call dword [esi + 0x3300c]
mov ebp, dword [esi + 0x33014]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x432600
sub esp, 0xffffff80
jmp 0x403670
Function at 0x102ab058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.102ab1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x102ab07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x102ab06a
add dl, dl
jne 0x102ab089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x102ab0dc
xor eax, eax
add dl, dl
jne 0x102ab096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x102ab17d
add dl, dl
jne 0x102ab0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102ab0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102ab0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102ab0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x102ab0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x102ab075
mov eax, 1
add dl, dl
jne 0x102ab0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x102ab0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x102ab0e1
sub eax, ebx
mov ebx, 1
jne 0x102ab128
mov ecx, 1
add dl, dl
jne 0x102ab10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x102ab119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x102ab105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x102ab075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x102ab13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x102ab14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x102ab136
cmp eax, 0x7d00
jae 0x102ab16d
cmp eax, 0x500
jb 0x102ab168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x102ab075
cmp eax, 0x7f
ja 0x102ab170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x102ab075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x102ab19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x102ab075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40d8ee
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6bd251ed
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
mov eax, section..rsrc
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x58f81678
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x100e4612
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0xbc
jmp 0x100e45e0
lea esp, [esp + 1]
lea edi, [esp + 4]
mov cx, 0x89d4
mov ah, 0x11
btc dx, sp
jmp 0x100e45fa
mov ebp, esp
mov dx, 0x893b
mov ax, si
rdtsc
bswap edx
jmp 0x100e46b6
ja 0x100e45b4
jbe 0x100e45b4
cmp al, 0xbc
push edx
xor eax, 0x890a74c4
sbb dword [eax - 0x75], edi
cmp ebp, dword [edx + ebp - reloc.MSVCRT.dll_malloc]
retf
lea esp, [esp + 3]
setae dl
jmp 0x100e45cc

Function at 0x1030ffb3
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf si, si
clc
mov byte [esp + 3], al
jmp 0x1030ffd9

Function at 0x1031043b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], ebp
mov dword [esp], ebx
dec bx
pop cx
bt ecx, ecx
not ax
mov bp, 0x8810
xchg bl, ch
jmp 0x10310423

Function at 0x1031d72e
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0x1031000a
call fcn.1031000f
movzx ebx, word [eax + 0x3c]
jmp 0x1031d6c2
add ebx, eax
jmp 0x1031d700
lea esp, [esp + 8]
xor ax, ax
cmp word [eax], 0x5a4d
je 0x10310177
sub eax, 0x10000
jmp 0x1031d6df
cmp word [ebx], 0x4550
jmp 0x1031d74e
push word [esp]
lea esp, [esp + 2]
jmp 0x1031d6d8
je 0x1030e0ef
jne 0x1031d6ea
and byte [eax + 0x17a8593e], ch
dec esi
lds edx, [ebp + 0x3c]
iretd

Function at 0x18e9914
Capabilities:
Encode data using xor

Disassembly:
bt sp, 7
add dl, dl
call fcn.029f653a
adc eax, 0x7ad9504b
aas
xor ecx, ebx
mov esi, dword [eax - 0x2dbb8133]
xor byte [esi + 0x3b], al
push ebx
sub eax, 0xfb962014
in eax, 0x30
daa
mov ecx, 0x9f2b9e07
adc dword [esi - 0x51], esi
movsb byte es:[edi], byte [esi]
inc ebp
xchg ebx, eax
mov esi, dword [ebx - 0x20]
sub dword [esi], esp
jecxz 0x18e9919
dec ebp
push ds
sbb ebx, dword [ebp + ebx*4 + 0x69a09f1a]
pop esi
fld xword [ebp + ebp - 0x66]
pop ds
xor al, 0xf5
test eax, 0x92f80b73
cli
sbb dword [ebx + 0x11a5610c], esi
test dword [edi - 0x5d], esp
inc eax
ret 0x8a99
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x4014f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Read and send data from client to server
Read file on windows
Send data
Send data on socket

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
mov eax, 0x11c4
call fcn.00402610
sub esp, eax
call fcn.00401710
lea eax, [ebp - 0x1a4]
mov dword [esp + 4], eax
mov dword [esp], 0x202
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov dword [esp], str.127.0.0.1
mov eax, dword [sym.imp.WS2_32.dll_inet_addr]
call eax
sub esp, 4
mov dword [ebp - 0x1b0], eax
mov word [ebp - 0x1b4], 2
mov dword [esp], 0x22b8
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [ebp - 0x1b2], ax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x1b4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_connect]
call eax
sub esp, 0xc
mov dword [esp + 4], 0x40404e
mov dword [esp], str.C:UsersCrushDesktop_secret_sslkeys.log
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40160c
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov eax, 1
jmp 0x401661
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
lea eax, [ebp - 0x11b4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 1
lea eax, [ebp - 0x11b4]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x4015e3
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret

Function at 0x4018d0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00402660
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00402660
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x401930
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x406068]
test esi, esi
jle 0x401a50
mov eax, dword [0x40606c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401964
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x4019e7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401950
mov dword [esp], ebx
call fcn.00402340
mov edi, eax
test eax, eax
je 0x401a77
mov eax, dword [0x40606c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402480
mov edx, dword [0x40606c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401a57
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x4019e0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x4019f0
add dword [0x406068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40606c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x4019e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004018d0
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x40196e
mov eax, dword [0x40606c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004018d0
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004018d0
lea esi, [esi]
nop

Function at 0x401f90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40607c]
sub esp, 4
test ebx, ebx
je 0x401fe5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401fde
test esi, esi
je 0x401fde
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401fc0
mov dword [esp], 0x406084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402210
Capabilities:
Parse pe header
Terminate process

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_exit]
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__exit]
mov eax, dword [esp + 4]
xor edx, edx
cmp word [eax], 0x5a4d
jne 0x402248
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
je 0x402250
mov eax, edx
ret
xor edx, edx
cmp word [eax + 0x18], 0x10b
sete dl
mov eax, edx
ret

Function at 0x402340
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402365
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402370
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402365
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x4023b8
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4023ae
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4023ba
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4023a0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40fc74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
mov dword [ebp - 4], 0x7863513
call dword [0x4b53a4]
mov ebx, eax
push ebx
call fcn.004521fb
mov edx, eax
pop ecx
test edx, edx
je 0x40fcba
push edi
xor edi, edi
test ebx, ebx
je 0x40fcb9
sub esi, edx
mov eax, edi
and eax, 3
lea ecx, [edi + edx]
mov al, byte [ebp + eax - 4]
xor al, byte [esi + ecx]
inc edi
mov byte [ecx], al
cmp edi, ebx
jb 0x40fca3
pop edi
pop esi
mov eax, edx
pop ebx
leave
ret
Function at 0x420c8a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x28
mov eax, 0x4a1aee
call fcn.00473d21
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x28], 0x74736e49
mov dword [ebp - 0x24], 0x536c6c61
mov dword [ebp - 0x20], 0x6c656968
mov word [ebp - 0x1c], 0x64
cmp byte [ebp + 0xc], bl
je 0x420ccf
mov dword [ebp - 0x1b], 0x7a695720
mov dword [ebp - 0x17], 0x647261
push 1
lea eax, [ebp - 0x29]
push eax
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
call fcn.00411380
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], 1
mov eax, esi
call fcn.00473cd0
ret 8
Function at 0x42e044
Capabilities:
Persist via run registry key

Disassembly:
push 0x434
mov eax, 0x4a50cf
call fcn.00473d21
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 4], ebx
push 0x2001f
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerRunOnceEntries
push 0x80000002
lea ecx, [ebp - 0x43c]
call fcn.004018f0
test eax, eax
jne 0x42e1a7
push 0x40e
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push ebx
push eax
mov esi, ebx
call fcn.00474cd0
add esp, 0xc
lea eax, [ebp - 0x440]
push ebx
push ebx
push eax
push ebx
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x420]
push eax
mov dword [ebp - 0x430], 0x208
push ebx
jmp 0x42e180
inc esi
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], ebx
mov byte [ebp - 4], 1
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
lea ecx, [ebp - 0x42c]
call fcn.004018f0
test eax, eax
jne 0x42e122
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x42c]
push eax
mov ecx, edi
call fcn.00436b72
test eax, eax
jne 0x42e196
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
push 0x80000002
lea ecx, [ebp - 0x42c]
call fcn.004018f0
test eax, eax
jne 0x42e159
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x42c]
push eax
mov ecx, edi
call fcn.00436b72
test eax, eax
jne 0x42e196
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x42c]
call fcn.004018c0
push ebx
push ebx
lea eax, [ebp - 0x440]
push eax
push ebx
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x420]
push eax
push esi
push dword [ebp - 0x43c]
call dword [0x4b503c]
test eax, eax
je 0x42e0d4
jmp 0x42e1a7
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x42c]
call fcn.004018c0
xor ebx, ebx
inc ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x43c]
call fcn.004018c0
mov eax, ebx
call fcn.00473cd0
ret 4
Function at 0x43e22a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x43e25a
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ecx + 0xd8]
mov ecx, dword [ebp + 0x10]
movzx eax, byte [esi]
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [edi + eax*4]
inc esi
dec edx
jne 0x43e242
pop edi
pop esi
jmp 0x43e25d
mov ecx, dword [ebp + 0x10]
mov eax, ecx
pop ebp
ret 0xc

Function at 0x44831e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 8
mov eax, 0x4ac5ec
call fcn.00473cee
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0x13
xor ebx, ebx
cmp dword [esi + 0x6c], ebx
je 0x448349
push dword [esi + 0x6c]
call fcn.00470ea0
pop ecx
mov dword [esi + 0x6c], ebx
push dword [esi + 0x68]
call fcn.00472d16
pop ecx
mov dword [esi + 0x68], ebx
mov byte [ebp - 4], 0x12
lea ecx, [esi + 0x348]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0x12
call fcn.00401b80
mov byte [ebp - 4], 0x11
lea ecx, [esi + 0x318]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0x11
call fcn.00401b80
mov byte [ebp - 4], 0x10
lea ecx, [esi + 0x2e8]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0x10
call fcn.00401b80
mov byte [ebp - 4], 0xf
lea ecx, [esi + 0x2b8]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xf
call fcn.00401b80
mov byte [ebp - 4], 0xe
lea ecx, [esi + 0x288]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xe
call fcn.00401b80
mov byte [ebp - 4], 0xd
lea ecx, [esi + 0x258]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xd
call fcn.00401b80
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0x228]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xc
call fcn.00401b80
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x1f8]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xb
call fcn.00401b80
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x1c8]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 0xa
call fcn.00401b80
mov byte [ebp - 4], 9
lea ecx, [esi + 0x198]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 9
call fcn.00401b80
mov byte [ebp - 4], 8
lea ecx, [esi + 0x168]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 8
call fcn.00401b80
mov byte [ebp - 4], 7
lea ecx, [esi + 0x138]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 7
call fcn.00401b80
mov byte [ebp - 4], 6
lea ecx, [esi + 0x108]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 6
call fcn.00401b80
mov byte [ebp - 4], 5
lea ecx, [esi + 0xd8]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 5
call fcn.00401b80
mov byte [ebp - 4], 4
lea ecx, [esi + 0xa8]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 4
call fcn.00401b80
mov byte [ebp - 4], 3
lea ecx, [esi + 0x78]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 3
call fcn.00401b80
mov byte [ebp - 4], 2
lea ecx, [esi + 0x5c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 2
call fcn.0044827b
mov byte [ebp - 4], 1
lea ecx, [esi + 0x54]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
call fcn.0044827b
mov byte [ebp - 4], bl
lea ecx, [esi + 0x4c]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], bl
call fcn.0044827b
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0x30]
call fcn.00417aeb
call fcn.00473cbc
ret