joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x61366f31
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data_1
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x551043e
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x43b665
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x43b3c1
inc edx
dec ebx
call fcn.0043b693
inc edx
add ebx, 0x98489dcf
dec ebx
xor dword [eax], esi
add ebx, 0x6b498cc8
inc eax
and edx, ebx
cmp eax, edi
jne fcn.0043b665
sub ebx, 0x7c2e42f7
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x7a542932
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x61211d1e
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x8bf7cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xcbee96
jmp 0xcbef9f
pop eax
add esp, 4
mov dword [esp], ebp
jmp 0xcbefb2
push esi
push eax
mov eax, 0xb2b66e5
mov dword [esp + 4], eax
push dword [esp]
jmp 0xcbef42
jmp 0xcd6a00
push eax
mov eax, esp
add eax, 4
sub esp, 4
mov dword [esp], ebp
mov ebp, 0x14
add eax, 0x6ffde3a3
jmp 0xcd23a5
sub esp, 4
mov dword [esp], esp
add dword [esp], 4
mov ebp, dword [esp]
push edi
mov edi, esp
push ebx
mov ebx, 0x7fd365bf
inc ebx
sub ebx, 0x5ff80e0c
jmp 0xcd6a82
xor ebx, 0x1fdb57b0
add edi, ebx
pop ebx
add edi, 4
xchg dword [esp], edi
pop esp
jmp 0xcd6b46
jmp 0xcd2290
Function at 0x5e7121
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5e713c
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124ac361]
pop edx
test eax, eax
je 0x5e720e
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5e71fd
test dword [ebp - 0x2a8], 1
jne 0x5e71fd
and dword [ebp - 0x2a8], 0x100
jne 0x5e71fd
push esi
push edx
push 4
push esi
call dword [edx + 0x122d2c6f]
pop edx
pop esi
test eax, eax
je 0x5e71a0
jmp 0x5e71fd
cmp word [esi], 0x5a4d
jne 0x5e71fd
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5e71fd
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d2b77]
pop edx
test eax, eax
je 0x5e71fd
lea eax, [ebp - 0x28c]
push eax
call fcn.005e707d
test eax, eax
jne 0x5e71f6
jmp 0x5e71fd
mov eax, esi
jmp 0x5e720e
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5e713c
pop esi
leave
ret 4

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x402874
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x4028a3
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403864
jmp 0x4028c1
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.0040279c
mov edi, eax
test ebx, ebx
je 0x4028c1
cmp dword [esi], 0
je 0x4028c1
dec ebx
jmp 0x4028aa
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402a90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402b28
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402b08
xor eax, eax
push ebp
push 0x402b01
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402b44
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402b08
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x404c14
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404dd0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404c75
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404dec
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404ce7
xor eax, eax
push ebp
push 0x404ce0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00404a6c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404cc9
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404e0c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404ce7
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404dc8
cmp byte [ebp - 0xd], 0
jne 0x404d29
cmp byte [ebp - 0x12], 0
je 0x404dc8
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404d42
dec ebx
cmp byte [ebx], 0x2e
je 0x404d51
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404d41
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404dc8
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404d7e
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404dc8
cmp byte [ebp - 0xd], 0
je 0x404dc8
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404dc8
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40961c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x409655
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403864
jmp 0x40965e
mov eax, ebx
mov edx, esi
call fcn.004037d0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x409668
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x409689
mov al, byte [esp]
jmp 0x40968b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40c2b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x40c360
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, edi
call fcn.00406ec4
cmp dword [ebp - 0xc], 0
jne 0x40c2f3
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.004037d0
jmp 0x40c34a
mov ebx, 0x104
mov eax, esi
mov edx, ebx
call fcn.00403cb0
call fcn.0040c204
push eax
push ebx
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 8]
call fcn.00403b9c
push eax
mov eax, edi
call fcn.00403b9c
push eax
mov eax, dword [ebp - 4]
call fcn.00403b9c
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov edx, ebx
dec edx
cmp eax, edx
jne 0x40c342
add ebx, 0x104
mov eax, esi
mov edx, ebx
call fcn.00403cb0
jmp 0x40c301
mov edx, esi
xchg edx, eax
call fcn.00403cb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c367
lea eax, [ebp - 0xc]
call fcn.0040377c
ret

Function at 0x40c664
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x40c714
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, edi
call fcn.00406ec4
cmp dword [ebp - 0xc], 0
jne 0x40c6a7
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.004037d0
jmp 0x40c6fe
mov ebx, 0x104
mov eax, esi
mov edx, ebx
call fcn.00403cb0
call fcn.0040c19c
push eax
push ebx
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 8]
call fcn.00403b9c
push eax
mov eax, edi
call fcn.00403b9c
push eax
mov eax, dword [ebp - 4]
call fcn.00403b9c
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov edx, ebx
dec edx
cmp eax, edx
jne 0x40c6f6
add ebx, 0x104
mov eax, esi
mov edx, ebx
call fcn.00403cb0
jmp 0x40c6b5
mov edx, esi
xchg edx, eax
call fcn.00403cb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c71b
lea eax, [ebp - 0xc]
call fcn.0040377c
ret
Function at 0x410dd4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x410f49
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x104
lea eax, [ebx + 1]
call fcn.00406d8c
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x410ea0
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.kernel32.dll_GetTempPathA
test eax, eax
jne 0x410e30
call sub.kernel32.dll_GetLastError
mov ebx, eax
call fcn.004032ec
jmp 0x410f33
cmp ebx, eax
jae 0x410e44
lea ebx, [eax + 1]
lea edx, [ebx + 1]
lea eax, [ebp - 8]
call fcn.00402680
jmp 0x410e11
lea edx, [ebx + 0xf]
lea eax, [ebp - 0xc]
call fcn.00403cb0
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0x410f5c
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
jne 0x410e78
call sub.kernel32.dll_GetLastError
mov ebx, eax
call fcn.004032ec
jmp 0x410f33
mov eax, dword [ebp - 0xc]
call fcn.004073e0
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.00403cb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410ea7
mov eax, dword [ebp - 8]
call fcn.00402668
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410f50
lea eax, [ebp - 0xc]
call fcn.0040377c
ret
Function at 0x411314
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41153d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.0041129c
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x411527
test ebx, ebx
je 0x411527
push 1
call sub.msi.dll_MsiCreateRecord
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x411527
xor eax, eax
push ebp
push 0x411520
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.0040377c
call fcn.00411208
push 1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0xb
lea ecx, [ebp - 0x24]
lea eax, [ebp - 0xc]
mov edx, 0x411554
call fcn.00407a30
mov eax, 0x10
call fcn.00411880
test al, al
jne 0x4114b7
mov eax, 0x12
call fcn.00411880
test al, al
jne 0x4114b7
mov eax, 0x11
call fcn.00411880
test al, al
jne 0x4114b7
mov eax, dword [ebp - 0xc]
call fcn.00403b9c
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.msi.dll_MsiRecordSetStringA
test eax, eax
je 0x4113f6
call fcn.004032ec
jmp 0x411527
mov eax, dword [ebp - 0xc]
call fcn.004039d8
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.00406d8c
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4114b0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.msi.dll_MsiFormatRecordA
sub eax, 1
jb 0x41145b
sub eax, 0xe9
jne 0x41144c
inc dword [ebp - 0x10]
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00402680
jmp 0x41141b
call fcn.004032ec
call fcn.004032ec
jmp 0x411527
mov eax, dword [ebp - 0x14]
push eax
push 1
mov eax, dword [ebp - 8]
push eax
call sub.msi.dll_MsiRecordSetStringA
test eax, eax
jne 0x411482
push 0x411560
push 0
mov eax, dword [ebp - 8]
push eax
call sub.msi.dll_MsiRecordSetStringA
test eax, eax
je 0x411491
call fcn.004032ec
call fcn.004032ec
jmp 0x411527
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_OutputDebugStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4114f8
mov eax, dword [ebp - 0x14]
call fcn.00402668
ret
push 0x411560
push 0
mov eax, dword [ebp - 8]
push eax
call sub.msi.dll_MsiRecordSetStringA
test eax, eax
jne 0x4114e3
mov eax, dword [ebp - 0xc]
call fcn.00403b9c
push eax
push 1
mov eax, dword [ebp - 8]
push eax
call sub.msi.dll_MsiRecordSetStringA
test eax, eax
je 0x4114ea
call fcn.004032ec
jmp 0x411527
mov eax, dword [ebp - 0xc]
call fcn.00403b9c
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 8]
push eax
push 0x4000000
mov eax, dword [ebp - 4]
push eax
call sub.msi.dll_MsiProcessMessage
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411527
lea eax, [ebp - 8]
call fcn.00411564
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411544
lea eax, [ebp - 0xc]
call fcn.0040377c
ret
Function at 0x417648
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x417795
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 0x4177ac
call fcn.00411164
xor eax, eax
push ebp
push 0x417778
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x104
lea eax, [ebx + 1]
call fcn.00406d8c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x41775e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.kernel32.dll_GetTempPathA
mov esi, eax
test esi, esi
jne 0x4176cc
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x4177c8
call fcn.00411590
cmp ebx, esi
jae 0x4176e0
lea ebx, [esi + 1]
lea edx, [ebx + 1]
lea eax, [ebp - 8]
call fcn.00402680
jmp 0x4176a1
lea edx, [ebx + 0xf]
mov eax, edi
call fcn.00403cb0
mov eax, dword [edi]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00403b9c
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetTempFileNameA
test eax, eax
jne 0x417738
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00410d2c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x4177f4
call fcn.00411590
mov eax, dword [edi]
call fcn.004073e0
mov edx, eax
mov eax, edi
call fcn.00403cb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417765
mov eax, dword [ebp - 8]
call fcn.00402668
ret

Function at 0x417f1c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x417ffb
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x417fd8
cmp ebx, 0x642
je 0x417fd8
cmp ebx, 0x669
je 0x417fd8
cmp ebx, 0xbc2
je 0x417fd8
push 0x14
push 0x418008
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.004095d0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
mov dword [ebp - 0xc], ebx
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x418034
call fcn.00407a1c
mov eax, dword [ebp - 4]
call fcn.00403b9c
push eax
push 0
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x417fd8
push 1
push 0x4180c4
push 0x4180c4
lea eax, [ebp - 0x1c]
call fcn.00417e34
mov eax, dword [ebp - 0x1c]
call fcn.00403b9c
push eax
push 0x4180c8
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418002
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004037a0
lea eax, [ebp - 4]
call fcn.0040377c
ret
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rsrc
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6c987a6c
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..text
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x651f206b
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x401428
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ecx + 0x28]
test edi, edi
jne 0x40144c
push edi
push esi
push dword [ebp + 8]
push edx
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setg al
jmp 0x40145c
mov eax, dword [edi]
push esi
push dword [ebp + 8]
push edx
push edi
call dword [eax + 0xc]
shr eax, 0x1f
xor al, 1
test al, al
jne 0x401463
and dword [esi], 0
pop edi
movzx eax, al
pop esi
pop ebp
ret 8

Function at 0x4020b6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x468080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, edx
xor eax, eax
push edi
mov edi, ecx
mov word [esi], ax
call fcn.0040b9b7
cmp eax, 0x104
jbe 0x4020e7
xor eax, eax
jmp 0x402186
push ebx
mov ebx, 0x10c
lea ecx, [ebp - 0x21c]
push ebx
mov edx, edi
call fcn.0040bc07
push ebx
mov edx, 0x43b76c
lea ecx, [ebp - 0x21c]
call fcn.0040bc56
lea eax, [ebp - 0x220]
xor ebx, ebx
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x21c]
mov dword [ebp - 0x220], ebx
mov ecx, Ordinal_1
call fcn.0040c1f1
test eax, eax
jne 0x40216b
cmp dword [ebp - 0x228], 1
mov dword [ebp - 0x224], 0xc8
jne 0x40214a
mov byte [esi], bl
lea eax, [ebp - 0x224]
push eax
push esi
lea eax, [ebp - 0x228]
push eax
push ebx
push ebx
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40216e
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x220], 0
je 0x402183
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004370bb
leave
ret 4
Function at 0x403794
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x468080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x218], 0x208
push edi
mov edi, eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], eax
mov edx, str.ddeexecApplication
lea eax, [ebp - 0x210]
mov ebx, ecx
push eax
push 0x20019
push ecx
call fcn.0040c1f1
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40383a
movzx eax, byte [ebp - 0x20c]
xor ecx, ecx
cmp dword [ebp - 0x21c], 1
cmove eax, ecx
mov byte [ebp - 0x20c], al
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x21c]
push eax
push ecx
push ecx
push dword [ebp - 0x210]
call esi
test eax, eax
jne 0x40383a
xor edx, edx
lea ecx, [ebp - 0x20c]
call fcn.0040bc95
mov edi, eax
test edi, edi
jne 0x403917
lea eax, [ebp - 0x214]
mov dword [ebp - 0x218], 0x208
push eax
push 0x20019
push ecx
mov edx, str.command
mov ecx, ebx
call fcn.0040c1f1
test eax, eax
jne 0x403917
movzx eax, byte [ebp - 0x20c]
xor ecx, ecx
cmp dword [ebp - 0x21c], 1
cmove eax, ecx
xor ebx, ebx
mov byte [ebp - 0x20c], al
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push ebx
push dword [ebp - 0x214]
call esi
test eax, eax
jne 0x403919
mov edx, str..exe
lea ecx, [ebp - 0x20c]
call fcn.0040bd36
lea ecx, [ebp - 0x20c]
test eax, eax
jne 0x4038d3
mov eax, ebx
cmp word [ebp - 0x20c], ax
je 0x4038d7
lea ecx, [ecx + 2]
inc eax
cmp word [ecx], bx
jne 0x4038c8
jmp 0x4038d7
sub eax, ecx
sar eax, 1
cmp eax, 0x104
jae 0x403919
lea ecx, [eax + eax]
cmp ecx, 0x208
jae 0x403958
xor edx, edx
mov word [ebp + ecx - 0x20c], dx
test eax, eax
je 0x403903
dec eax
cmp word [ebp + eax*2 - 0x20c], 0x5c
jne 0x4038f3
lea ecx, [ebp - 0x20a]
xor edx, edx
lea ecx, [ecx + eax*2]
call fcn.0040bc95
mov edi, eax
jmp 0x403919
xor ebx, ebx
cmp dword [ebp - 0x210], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x403930
push dword [ebp - 0x210]
call esi
cmp dword [ebp - 0x214], 0
mov dword [ebp - 0x210], ebx
je 0x403947
push dword [ebp - 0x214]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004370bb
leave
ret
call fcn.00437295
int3