joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405008
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x41c194]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, edx
mov esi, ecx
push 0x41cb50
push edi
mov dword [ebp - 0x410], esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40512f
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push edi
mov dword [ebp - 0x414], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405122
push 0
lea eax, [ebp - 0x40c]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jle 0x40511b
mov edx, dword [ebp - 0x40c]
test edx, edx
je 0x40511b
lea ecx, [ebp - 0x404]
call fcn.00407b7c
mov dword [0x41c19c], eax
cmp eax, 0xffffffff
je 0x40510b
mov esi, dword [esi]
lea eax, [ebp - 0x408]
push eax
push 0x401520
push dword [ebp - 0x410]
mov esi, dword [esi]
mov ecx, esi
call dword [0x41f4a8]
call esi
test eax, eax
js 0x40510b
mov eax, dword [ebp - 0x408]
push dword [0x41c19c]
push 1
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x64]
mov ecx, esi
call dword [0x41f4a8]
call esi
mov eax, dword [ebp - 0x408]
push eax
mov edx, dword [eax]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x41f4a8]
call esi
push edi
mov edx, 0x104
mov ecx, 0x41cb50
call fcn.00405313
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0041b4e0
mov esp, ebp
pop ebp
ret

Function at 0x4053be
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
mov dword [0x41e6c4], 0x415e20
push eax
push 0xd
push 0x400
mov dword [0x41e6cc], 0xc
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp word [ebp - 4], 0x31
jne 0x405412
mov eax, 0x3e8
mov dword [0x41e690], 0xa006
mov dword [0x41e6b0], eax
mov dword [0x41e6b8], eax
mov eax, 0x2ee
jmp 0x405430
mov eax, 0x9c4
mov dword [0x41e690], 0xa00a
mov dword [0x41e6b0], eax
mov dword [0x41e6b8], eax
mov eax, 0x7d0
mov dword [0x41e6b4], eax
mov dword [0x41e6ac], eax
mov esp, ebp
pop ebp
ret
Function at 0x40762f
Capabilities:
Open clipboard

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [0x41d1dc]
xor esi, esi
mov dword [ebp - 0xc], ecx
and dword [ebp - 4], esi
call dword [sym.imp.USER32.dll_GetMenu]
mov edi, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0xb0
push dword [0x41d1d4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 4]
xor ebx, ebx
cmp eax, dword [ebp - 8]
sete bl
push ebx
push 0x300
push 1
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push ebx
push 0x301
push 1
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push ebx
push 0x303
push 1
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push esi
push 0x19
push 1
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_GetMenuState]
cmp eax, 1
jne 0x4076e4
cmp ebx, eax
jne 0x4076e4
push esi
push 0x19
push eax
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x407701
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
xor ecx, ecx
test esi, esi
sete cl
push ecx
push 0x302
push 1
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0
push 0
push 0xe
push dword [0x41d1d4]
call dword [sym.imp.USER32.dll_SendMessageW]
neg eax
sbb esi, esi
not esi
and esi, 1
push esi
push 0x15
push 1
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push esi
push 0x16
push 1
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
xor eax, eax
cmp dword [0x41d1bc], eax
setne al
push eax
push 0x18
push 1
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0
push 0
push 0xc6
push dword [0x41d1d4]
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
test eax, eax
sete cl
push ecx
push 0x10
push 1
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov eax, dword [0x41d1bc]
neg eax
sbb eax, eax
and eax, 8
push eax
push 0x20
push 2
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov eax, dword [0x41d1cc]
neg eax
sbb eax, eax
and eax, 8
push eax
push 0x1b
push 3
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4081dd
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41c194]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
inc esi
cmp ecx, esi
jne 0x40821e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0x10
lea ecx, [ebp - 0x24]
movzx eax, ax
push ecx
push 0x58
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x408232
test dword [ebp - 0x16], 0x800
jne 0x408234
jmp 0x408232
cmp ecx, 6
je 0x408234
cmp ecx, 0x17
je 0x408234
cmp ecx, 0xa
je 0x408234
cmp ecx, 8
je 0x408234
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041b4e0
mov esp, ebp
pop ebp
ret

Function at 0x408245
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x41c194]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x294
lea eax, [ebp - 0x400]
mov edi, ecx
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x410]
xor ebx, ebx
inc ebx
mov esi, ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x10
lea eax, [ebp - 0x24]
mov dword [ebp - 0x414], ebx
push eax
push 0x58
mov ebx, 0x400
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4082da
test dword [ebp - 0x16], 0x800
je 0x4082da
push 2
lea eax, [ebp - 0x414]
push eax
push 0x20001009
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [ebp - 0x414]
call fcn.004081dd
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x10
add esi, 0x11
push 0x50
lea eax, [ebp - 0x168]
push eax
push 0
lea eax, [ebp - 0x410]
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push 0x50
lea eax, [ebp - 0xc8]
push eax
push 0
lea eax, [ebp - 0x410]
push eax
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
mov ebx, 0x401704
mov esi, 0x14a
test edi, edi
je 0x40832b
push ebx
mov edx, esi
lea ecx, [ebp - 0x400]
call fcn.004083a2
lea eax, [ebp - 0xc8]
mov edx, esi
push eax
lea ecx, [ebp - 0x400]
call fcn.004083a2
push 0x40170c
mov edx, esi
lea ecx, [ebp - 0x400]
call fcn.004083a2
lea eax, [ebp - 0x168]
mov edx, esi
push eax
lea ecx, [ebp - 0x400]
call fcn.004083a2
test edi, edi
je 0x408377
push ebx
mov edx, esi
lea ecx, [ebp - 0x400]
call fcn.004083a2
lea eax, [ebp - 0x400]
push eax
push 1
push 0xc2
push dword [0x41d1d4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041b4e0
mov esp, ebp
pop ebp
ret

Function at 0x408410
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
je 0x40843c
sub esi, edx
mov ax, word [edx]
movzx ecx, byte [edx + 1]
shl ax, 8
xor cx, ax
mov word [esi + edx], cx
lea edx, [edx + 2]
sub edi, 1
jne 0x408422
pop edi
pop esi
pop ebp
ret 4
Function at 0x408442
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0x10], 0
mov eax, edx
mov ecx, dword [0x41e6dc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jne 0x408466
xor eax, eax
inc eax
jmp 0x4084ef
push esi
lea esi, [eax - 0xfde9]
neg esi
lea ecx, [ebp - 0x10]
sbb esi, esi
and esi, ecx
xor ecx, ecx
push esi
push ecx
push ecx
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 4], eax
test eax, eax
je 0x4084ee
push edi
inc eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
jne 0x4084b0
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4084ed
push esi
push 0
push dword [ebp - 4]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
je 0x4084e4
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
push edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x408559
Capabilities:
Get graphical window text

Disassembly:
cmp dword [0x41d1bc], 0
je 0x408592
cmp dword [0x41cf8c], 0
je 0x408575
mov ecx, 0x50200104
jmp fcn.00415238
push dword [0x41d524]
push dword [0x41d520]
push 0xb1
push dword [0x41d1d4]
call dword [sym.imp.USER32.dll_SendMessageW]
ret
Function at 0x4096da
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
and dword [ebp - 4], 0
push esi
lea esi, [eax + eax]
mov dword [ebp - 8], esi
test ecx, ecx
je 0x409712
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409712
cmp dword [ebp - 4], 1
je 0x409721
push esi
push dword [ebp + 8]
push dword [ebp + 0xc]
call sub.msvcrt.dll_memcpy
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41802d
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x41c194]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
mov edx, 0x104
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [eax], edi
mov dword [eax + 4], edi
call fcn.00405313
push 0x401da8
lea ecx, [esp + 0x1c]
call fcn.00417428
lea eax, [esp + 0x18]
push eax
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x4180af
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4180e9
mov ecx, dword [ebp + 4]
mov edx, 0xc8
push 0x401d60
call fcn.00417dc3
mov edi, eax
jmp 0x4180e9
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov ecx, esi
call fcn.00417f0e
mov ebx, eax
test ebx, ebx
jns 0x4180db
mov ecx, dword [ebp + 4]
mov edx, 0xce
push ebx
push 0x401d60
call fcn.00417da6
mov edi, ebx
jmp 0x4180e9
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
test esi, esi
je 0x4180f3
push esi
call fcn.00417e1f
mov ecx, dword [esp + 0x224]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041b4e0
mov esp, ebp
pop ebp
ret 8

Function at 0x419eae
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x419f1b
xor ebx, ebx
test eax, 0x4000
je 0x419ef0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_DecryptFileW]
test eax, eax
jne 0x419ef0
mov ecx, dword [ebp + 4]
mov edx, 0xd3
push 0x40426c
call fcn.00417dc3
jmp 0x419f1d
cmp word [edi], bx
je 0x419f1b
mov edx, edi
mov ecx, esi
call fcn.004195e1
mov esi, eax
test esi, esi
jns 0x419f1b
mov ecx, dword [ebp + 4]
mov edx, 0xd9
push esi
push 0x40426c
call fcn.00417da6
mov eax, esi
jmp 0x419f1d
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x41b36c
Capabilities:
Delete file

Disassembly:
add ebx, 0x2a8dba92
shld ecx, eax, cl
mov esi, 0xe69f0c3d
mov ecx, edi
pop ebx
add ebx, 0x2b7582a
mov ecx, 0xb0b1063f
ror dl, cl
bsf ecx, eax
sub ebx, 0x2b52b84
lea edi, [0x21362fdc]
test ch, 0xf1
xadd dl, al
push ebx
add ebx, 0x2d1
test edx, ebx
imul edi, esi, 0x61766f1c
mov al, dh
add ebx, 0x640
and ecx, 0x1960f3c
cmp al, dh
movzx ecx, di
add ebx, 0x805
xadd eax, ecx
imul edi, esi, 0x41d64f
dec dl
push ebx
sub ebx, 0x2437423
bsf ecx, eax
bsf edi, esi
bsf edi, esi
add ebx, 0x243630d
mov ecx, 0x5126df4c
mov al, dh
and ecx, edi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop ebx
push ebx
add eax, ebp
inc edi
rcl esi, 1
ret
Function at 0x41b834
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x41bd98
call fcn.0041bb5c
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x41b894
cmp eax, 0xffffffff
je 0x41b894
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x41b88d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x41b88d
cmp edx, 0x10000000
jae 0x41b88d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x41b88a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.0041bba1
ret 4

Function at 0x41b8f0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x41b92e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x41b926
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x41b930
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x41b916
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x41ba00
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x41ba16
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x41ba31
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x6fb57a37
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x1b53753b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x62
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x1b70a28
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1b70a32
pushal
call 0x1b70a38
pop ebp
sub ebp, 0x10
sub ebp, 0x1770a28
jmp 0x1b70a4e
mov eax, 0x1770a28
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b8
mov edx, 0x97da1dda
xor byte [eax], dl
inc eax
dec ecx
jne 0x1b70a65
jmp 0x1b70a78
push ecx
pop ss
push ecx
push ebx
out 0xda, al
fcmovu st(0), st(2)
pop ebx
sbb esp, dword [edx]
fcmovu st(0), st(2)
fcmovu st(0), st(1)
pop ss
invalid
Function at 0x100227f
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
push edi
mov esi, ecx
mov edi, section..data
push dword [esi + 0x34]
push dword [esi + 0x30]
call ebx
push dword [esi + 0x34]
mov byte [esi + 0x3d], 0
push dword [esi + 0x30]
call ebx
test eax, eax
je 0x100229d
cmp eax, 0xffffffff
je 0x100234b
call dword [0x10040dc]
mov dword [ebp - 4], eax
mov eax, dword [section..data]
cmp eax, edi
je 0x10022e3
test byte [eax + 0x1c], 2
je 0x10022e3
push dword [ebp - 4]
push 0x100136c
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100179b
cmp byte [esi + 0x3d], 0
jne 0x1002295
cmp dword [esi + 8], 0
jne 0x1002295
cmp dword [ebp - 4], 0
jne 0x1002295
call dword [sym.imp.ole32.dll_CoSuspendClassObjects]
cmp dword [esi + 8], 0
jne 0x1002295
call dword [0x10040dc]
test eax, eax
jne 0x1002295
mov eax, dword [section..data]
cmp eax, edi
je 0x100232e
test byte [eax + 0x1c], 2
je 0x100232e
push 0
push 0x100136c
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100179b
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0x12
push dword [esi + 0x2c]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [section..data]
cmp eax, edi
je 0x1002378
test byte [eax + 0x1c], 1
je 0x1002378
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [section..data]
push 0x100136c
push 0xd
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100179b
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10024f6
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
push esi
push esi
push esi
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x30], eax
cmp eax, esi
jne 0x1002517
xor eax, eax
jmp 0x100253d
push ebx
lea eax, [ebp - 4]
push eax
push esi
push edi
push 0x1002386
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
cmp ebx, esi
jne 0x100253a
push dword [edi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret
Function at 0x1003478
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 0xc]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x10014d0
push 0x80000002
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100353e
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
push 4
pop edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x1001520
push dword [ebp - 0xc]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10034df
mov eax, dword [ebp - 4]
mov dword [0x10044dc], eax
cmp dword [0x10044dc], ebx
je 0x1003533
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x1001550
push dword [ebp - 0xc]
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x100350d
mov eax, dword [ebp - 4]
mov dword [0x1004090], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x1001584
push dword [ebp - 0xc]
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1003533
mov eax, dword [ebp - 4]
mov dword [0x10044e0], eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
cmp dword [0x10044dc], ebx
pop ebx
je 0x1003554
push 0x10033f9
push 1
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
leave
ret
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x14c51299
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x606d18c5
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219