joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ef97
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40efa6
pop dword [ebp - 0x30]
mov eax, 0x91dd7646
sub eax, 0x919c86a0
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x45174a0a
sub dword [ebp - 0x40], 0xf6c504bf
mov dword [ebp - 0x3c], 0xb0438214
add dword [ebp - 0x3c], 0x81efca31
mov dword [ebp - 0x38], 0x85769332
sub dword [ebp - 0x38], 0x392a4f04
mov dword [ebp - 0x34], 0x72b35914
add dword [ebp - 0x34], 0x8d4ca6ec
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x49cc05a4
sub dword [ebp - 0x40], 0xd5599c4e
mov dword [ebp - 0x3c], 0x9236802d
sub dword [ebp - 0x3c], 0x50ca1eb8
mov dword [ebp - 0x38], 0x955e5f46
add dword [ebp - 0x38], 0xce110d26
mov dword [ebp - 0x34], 0x63742e0c
sub dword [ebp - 0x34], 0x63742e0c
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x408fc
push 0
call eax
mov ecx, 0x50fb
mov esi, eax
mov edi, 0x457a00
add edi, dword [ebp - 0x30]
mov ebx, 0x2bcb48f8
sub ebx, 0x970aacb0
mov edx, dword [edi]
add dword [ebp - 0x18], esi
xor edx, ebx
mov dword [ebp - 0x28], 0x230c41b9
mov dword [esi], edx
sub dword [ebp - 0x14], 0x4f9f0346
add esi, 0xcecc4c19
sub esi, 0xcecc4c15
add edi, 4
loop 0x40f0b2
add eax, 0x136bf
xor ebx, ebx
add ebx, eax
add eax, 0xa10d09c2
sub eax, 0xa10d09bd
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x4128d9
Capabilities:
Get common file path

Disassembly:
push 0x264
mov eax, 0x4375ca
call fcn.00433ea9
mov edi, ecx
xor esi, esi
push 0x20a
lea eax, [ebp - 0x224]
push esi
push eax
mov dword [ebp - 0x258], esi
call dword [sym.imp.MSVCR110.dll_memset]
add esp, 0xc
call fcn.0040ef97
test al, al
je 0x41299a
push str.IE_is_protected_mode_
lea ecx, [ebp - 0x23c]
call fcn.0040ef97
push str.LogSession
lea ecx, [ebp - 0x254]
mov dword [ebp - 4], esi
call fcn.0040ef97
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 1
call fcn.0040c42d
push 0x43f9ae
lea ecx, [ebp - 0x270]
mov esi, eax
call fcn.0040ef97
push eax
mov byte [ebp - 4], 2
mov edx, dword [esi]
lea eax, [ebp - 0x23c]
push eax
mov ecx, esi
call dword [edx + 0x40]
lea ecx, [ebp - 0x270]
call fcn.004023b1
lea ecx, [ebp - 0x254]
call fcn.004023b1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x23c]
call fcn.004023b1
mov ecx, edi
call fcn.0041283a
jmp 0x4129c7
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push 0x801a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, 0x43fc28
test eax, eax
lea ecx, [ebp - 0x224]
cmovne ecx, edx
push ecx
mov ecx, edi
call fcn.0040ef97
mov eax, edi
call fcn.00433e58
ret
Function at 0x2a3182db
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x2a3182ea
pop dword [ebp - 0x20]
mov eax, 0xd5a048f
sub eax, 0xe32881a5
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xcef11e69
add dword [ebp - 0x30], 0x7f6126e2
mov dword [ebp - 0x2c], 0xcaab8f6c
add dword [ebp - 0x2c], 0x6787bcd9
mov dword [ebp - 0x28], 0xb26b0130
sub dword [ebp - 0x28], 0x661ebd02
mov dword [ebp - 0x24], 0x9704eb34
sub dword [ebp - 0x24], 0x9704eb34
lea eax, [ebp - 0x30]
push eax
mov eax, 0xe1995263
sub eax, 0xb763d1df
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x380c05ef
sub dword [ebp - 0x30], 0xc3999c99
mov dword [ebp - 0x2c], 0x4e5178d8
sub dword [ebp - 0x2c], 0xce51763
mov dword [ebp - 0x28], 0x897909c
add dword [ebp - 0x28], 0x5ad7dbd0
mov dword [ebp - 0x24], 0xfdb0dd15
sub dword [ebp - 0x24], 0xfdb0dd15
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x4ba7e
push 0
call eax
mov ecx, 0x4cbb
mov ebx, eax
mov esi, 0x2a37f600
add esi, dword [ebp - 0x20]
mov edx, 0xe49a0b0a
mov dword [ebp - 0x14], 0x971d1ab6
mov edi, dword [esi]
sub dword [ebp - 0x18], 0xbf582b2e
xor edi, edx
sub dword [ebp - 0x18], edx
mov dword [ebx], edi
sub dword [ebp - 0xc], esi
add ebx, 0xea13ef82
sub ebx, 0xea13ef7e
add esi, 0x6a4dff96
sub esi, 0x6a4dff92
loop 0x2a3183f5
add eax, 0x63609f1
add eax, 0xf9cb1bce
mov ebx, eax
add eax, 0xcd25c522
sub eax, 0xcd25c51d
mov ecx, 0xc3244704
sub ecx, 0x98f44704
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x1004c974
Capabilities:
Terminate process

Disassembly:
jmp 0x100e1110
jmp fcn.100e2500
cmp ecx, dword [0x10107b60]
jne 0x100e111a
repz ret
jmp 0x1004cac8
Function at 0x1001a093
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1001a0a2
pop dword [ebp - 0x48]
mov eax, 0x1001a0a2
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x4024b
push 0
mov eax, 0xee791016
sub eax, 0xde75af3a
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x46a5
mov esi, eax
mov edx, 0x1003be00
add edx, dword [ebp - 0x48]
mov ebx, 0x135cb9ba
sub ebx, 0x68063108
mov dword [ebp - 0x1c], 0xf6ffab2a
mov edi, dword [edx]
add dword [ebp - 0x24], 0xb0ea7cae
xor edi, ebx
add dword [ebp - 0x24], 0xa48a693f
mov dword [esi], edi
xor dword [ebp - 0x34], edx
add esi, 0x87e85f43
add esi, 0x7817a0c1
add edx, 0xd11d7f2b
sub edx, 0xd11d7f27
loop 0x1001a0f0
add eax, 0x10d67
mov ebx, eax
add eax, 0x1e4c3a6c
add eax, 0xe1b3c599
mov ecx, 0xa190a3cb
sub ecx, 0x9190a3cb
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001a093
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001a093
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x21e7113
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
call esi
mov edi, eax
call 0x21e7076
push edi
imul ebp, dword [esi + 0x48], 0x52707474
popal
inc esp
popal
je 0x21e70d6
add byte [ebp - 1], dl
salc
mov ebp, eax
lea edx, [esp + 0x10]
push edx
push dword [esp + 0xc]
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x21e70c3
cmp eax, 0x1000
jbe 0x21e709a
mov eax, 0x1000
lea edx, [esp + 0x10]
push edx
push eax
lea edx, [esp + 0x1c]
push edx
push dword [esp + 0x14]
call ebp
push 0
lea edx, [esp + 0x14]
push edx
push dword [esp + 0x18]
lea edx, [esp + 0x20]
push edx
push dword [esp + 0x1c]
call ebx
jmp 0x21e707b
pop ebx
pop edi
pop eax
call 0x21e70d7
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x21e7135
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
add byte gs:[ebx - 1], dl
add byte [ebx - 1], dl
salc
push dword [esp]
call eax
call 0x21e70ec
push edi
imul ebp, dword [esi + 0x45], 0x636578
push ebx
call esi
push 1
lea edx, [esp + 0x1010]
push edx
call eax
call 0x21e710c
inc ebp
js 0x21e716c
je 0x21e7155
jb 0x21e7176
arpl word [ebp + 0x73], sp
jae 0x21e710c
push ebx
call esi
push 0
call eax
push edx
mov edx, dword fs:[0x30]
mov edx, dword [edx + 0xc]
add edx, 0xc
mov edx, dword [edx]
mov ecx, dword [edx + 0x30]
push ecx
push dword [esp + 0xc]
call 0x21e713b
test eax, eax
je 0x21e7121
mov eax, dword [edx + 0x18]
pop edx
ret 4
inc edx
sbb byte [edx - 0x3e], bl
add al, 0
push edx
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
movzx eax, word [ecx]
test ax, ax
je 0x21e7185
cmp ax, word [edx]
je 0x21e717a
cmp ax, 0x61
jb 0x21e715d
cmp ax, 0x7a
jbe 0x21e7169
cmp ax, 0x41
jb 0x21e7176
cmp ax, 0x5a
ja 0x21e7176
xor ax, 0x20
cmp ax, word [edx]
je 0x21e7174
and byte [esi + 0x3b], ah
add dh, byte [edx + eax - 0x15]
add ch, bl
add al, 0x31
shr bl, 0xe
jmp 0x21e7176
jmp 0x21e717a
xor eax, eax
jmp 0x21e7188
add ecx, 2
add edx, 2
movzx eax, word [ecx]
jmp 0x21e7147
or eax, 1
pop edx
ret 8

Function at 0x43b65b
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x43b3c1
add eax, 0x7d3d90c2
call fcn.0043b690
add eax, 0x1dc4da3f
xor dword [esi], ecx
and eax, eax
and eax, eax
dec edx
inc esi
or edx, eax
cmp esi, ebx
jne fcn.0043b65b
sub edx, eax
and edx, eax
add edx, edx
ret
Function at 0x3f72dfa8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
add eax, dword [esp + 0x18]
jmp 0x3f72dfc1
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x10]
mov eax, ecx
shl eax, 2
cmp ecx, 4
jl 0x3f72dfa2
add eax, ebx
mov ecx, dword [edi + 0x954]
mov esi, eax
shl esi, 2
cmp dword [esi + ecx], 0
je 0x3f72dfe1
mov eax, dword [edi + 0x954]
mov eax, dword [esi + eax]
pop edi
pop esi
pop ebx
ret 0xc
add eax, 0x3e8
movzx eax, ax
push 0xa
push eax
push dword [0x3f7ed018]
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x3f7d03f1
push eax
push dword [0x3f7ed018]
call dword [sym.imp.kernel32.dll_LoadResource]
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov ecx, dword [edi + 0x954]
mov dword [esi + ecx], eax
jmp 0x3f72dfd2
test ebx, ebx
jl 0x3f72dfd2
cmp ebx, 2
jle 0x3f7d0419
cmp ebx, 3
jne 0x3f72dfd2
mov eax, dword [edi + 0x954]
mov dword [esi + eax], 0x3f7d0430
jmp 0x3f72dfd2
mov eax, dword [edi + 0x954]
mov dword [esi + eax], 0x3f7d042c
jmp 0x3f72dfd2

Function at 0x3f74a63e
Capabilities:
Parse credit card information

Disassembly:
dec esi
test esi, esi
je 0x3f74a67b
mov cx, word [eax]
inc eax
inc eax
jmp 0x3f74a69e
dec esi
je 0x3f74a67b
mov cx, word [eax]
inc eax
inc eax
jmp 0x3f74a663
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
add edx, edx
add eax, edx
mov cx, word [eax]
inc eax
push ebx
mov ebx, dword [esp + 0x10]
inc eax
cmp cx, 0x3e
push esi
mov esi, dword [ebx]
je 0x3f74a634
cmp cx, 0x7d
je 0x3f74a634
cmp cx, 0x3a
je 0x3f74a682
cmp cx, 0x3b
je 0x3f74a682
cmp cx, 0x38
je 0x3f74a682
cmp cx, 0x25
je 0x3f74a682
xor eax, eax
pop esi
pop ebx
ret 0xc
dec esi
je 0x3f74a67b
mov cx, word [eax]
inc eax
inc eax
cmp cx, 0x2d
je 0x3f749e71
cmp cx, 0x5e
je 0x3f749e71
cmp cx, 0x28
je 0x3f74a6e7
cmp cx, 0x3e
je 0x3f74a6e7
cmp cx, 0x44
je 0x3f74a6e7
cmp cx, 0x49
je 0x3f74a6e7
cmp cx, 0x4f
je 0x3f74a6e7
cmp cx, 0x6f
je 0x3f74a6e7
cmp cx, 0x5c
je 0x3f74a6e7
cmp cx, 0x2f
je 0x3f74a6e7
cmp cx, 0x7c
je 0x3f74a6e7
cmp cx, 0x30
je 0x3f74a6f6
cmp cx, 0x29
jne 0x3f74a67b
cmp word [eax - 4], 0x38
je 0x3f74a67b
sub eax, edx
sub eax, dword [esp + 0xc]
sar eax, 1
mov dword [ebx], eax
xor eax, eax
inc eax
jmp 0x3f74a67d
cmp word [eax - 4], 0x38
jne 0x3f74a6e7
jmp 0x3f74a6da

Function at 0x3f768589
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x3f768598
pop dword [ebp - 0x1c]
mov eax, 0x3f768598
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x4abf3
push 0
mov eax, 0x8d802347
add eax, 0xb1ecedb9
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x4a88
mov ebx, eax
mov edx, 0xa54176a3
add edx, 0x9a40e95d
add edx, dword [ebp - 0x1c]
mov edi, 0x12396ad1
add edi, 0x2fdf058f
xor dword [ebp - 4], 0x7939c3bc
mov esi, dword [edx]
xor dword [ebp - 0x14], 0x6aeb4cda
sub esi, edi
sub dword [ebp - 4], 0xb842ee52
mov dword [ebx], esi
xor dword [ebp - 4], edi
add ebx, 4
add edx, 4
loop 0x3f7685ec
add eax, 0xe2e83a6e
sub eax, 0xe2e71d7b
mov ebx, eax
add eax, 5
mov ecx, sym.msgr3ge.dll_Ordinal_54
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x3f785b5c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_FindResourceW]
push 0xa
push 0x3e7
push dword [0x3f7ed018]
mov esi, ecx
call edi
mov ebx, dword [sym.imp.kernel32.dll_LoadResource]
push eax
push dword [0x3f7ed018]
call ebx
mov ebp, dword [sym.imp.kernel32.dll_LockResource]
push eax
call ebp
push 0xa
push 0x3e6
mov dword [esi + 0x950], eax
push dword [0x3f7ed018]
call edi
push eax
push dword [0x3f7ed018]
call ebx
push eax
call ebp
push 0xa
push 0x3e5
mov dword [esi + 0x94c], eax
push dword [0x3f7ed018]
call edi
push eax
push dword [0x3f7ed018]
call ebx
push eax
call ebp
movzx eax, word [eax]
lea edi, [esi + 0x95c]
mov dword [edi], eax
shl eax, 2
push 4
push eax
call fcn.3f7826e4
mov dword [esi + 0x954], eax
mov eax, dword [edi]
shl eax, 1
push eax
call fcn.3f72cdee
add esp, 0xc
pop edi
mov dword [esi + 0x958], eax
pop esi
pop ebp
pop ebx
ret

Function at 0x3f7b40e4
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x3f7edef0]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
xor ebx, ebx
xor esi, esi
cmp eax, ebx
push 2
pop ebp
jne 0x3f7b418e
call edi
mov esi, eax
cmp esi, ebx
je 0x3f7dabbd
mov dword [0x3f7edef0], 1
cmp esi, ebx
je 0x3f7dabde
cmp word [esi], bx
mov eax, esi
je 0x3f7b4137
add eax, ebp
cmp word [eax], bx
jne 0x3f7b4129
add eax, ebp
cmp word [eax], bx
jne 0x3f7b4129
mov edi, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, esi
push ebx
sar eax, 1
inc eax
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x3f7b417e
push ebp
call fcn.3f72cdee
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x3f7b417e
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
je 0x3f7dabeb
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
cmp eax, 1
jne 0x3f7dabfe
jmp 0x3f7b411a
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x78
jne 0x3f7dabd4
mov eax, ebp
mov dword [0x3f7edef0], eax
jmp 0x3f7b418e
mov eax, dword [0x3f7edef0]
jmp 0x3f7b418e
call edi
mov esi, eax
cmp esi, ebx
je 0x3f7dac06
jmp 0x3f7b4122
push dword [esp + 0x10]
call fcn.3f72cf31
pop ecx
mov dword [esp + 0x10], ebx
jmp 0x3f7b417a
cmp eax, ebp
je 0x3f7dac0d
cmp eax, ebx
je 0x3f7dac0d
xor eax, eax
jmp 0x3f7b4187
call dword [sym.imp.kernel32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
je 0x3f7dac06
cmp byte [esi], bl
je 0x3f7dac27
inc eax
cmp byte [eax], bl
jne 0x3f7dac1d
inc eax
cmp byte [eax], bl
jne 0x3f7dac1d
sub eax, esi
inc eax
mov ebp, eax
push ebp
call fcn.3f72cdee
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x3f7dac3d
xor edi, edi
jmp 0x3f7dac48
push ebp
push esi
push edi
call fcn.3f768589
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsA]
mov eax, edi
jmp 0x3f7b4187
Function at 0x3f7e3a9a
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x110
push esi
push edi
push dword [ebp + 0x7c]
xor esi, esi
push dword [ebp + 0x78]
mov dword [ebp + 0x64], ecx
mov dword [ebp + 0x68], esi
call fcn.3f768589
mov edi, eax
cmp edi, esi
je 0x3f7e3b71
push 0x80
lea eax, [ebp - 0x20]
push eax
push 0xc
push dword [0x3f7ed018]
call dword [sym.imp.user32.dll_LoadStringA]
test eax, eax
jle 0x3f7e3b6a
mov ecx, dword [ebp + 0x64]
push ebx
push dword [ebp + 0x78]
call fcn.3f791c67
push esi
push esi
mov ebx, eax
push 0x81
lea eax, [ebp - 0xa4]
push eax
push ebx
call fcn.3f70c181
pop ecx
inc eax
push eax
push ebx
push esi
push esi
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xa4]
push eax
push 1
push esi
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop ebx
jne 0x3f7e3b6a
push 0x80
lea eax, [ebp - 0x20]
push eax
push 0xd
push dword [0x3f7ed018]
call dword [sym.imp.user32.dll_LoadStringA]
test eax, eax
jle 0x3f7e3b6a
mov ecx, dword [ebp + 0x64]
lea eax, [ebp - 0x20]
push eax
push edi
push dword [ebp + 0x78]
push dword [ebp + 0x74]
call fcn.3f768589
mov dword [ebp + 0x68], eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x68]
pop edi
pop esi
add ebp, 0x6c
leave
ret 0xc
Function at 0x6fc02d90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6fc02deb
cmp byte [esi + ebx - 1], 0xa
je 0x6fc02dbf
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6fc04118], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x403bec
Capabilities:
Encode data using xor

Disassembly:
push 0x403d88
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
dec eax
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
fild qword [ebx + 0xe0876cf]
loope 0x403c54
mov esp, 0x133d314e
or dword [esp + ecx*2], ebp
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
sub eax, 0x30303043
sub eax, 0x714e5071
inc esp
jo 0x403c71
inc edx
add byte [eax], dh
xor al, 0x36
jge 0x403c59
xor ch, byte [esi]
add byte [ebx], ah
xor byte [ebx], ah
inc ebx
cmp bl, byte [edi + edx*2]
add byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [eax], al
push ds
add byte [esi], bl
aas
sub al, 0x1b
xchg edx, eax
and cl, byte [ebx - 0x79]
shr dword [esi - 0x31], 1
loope 0x403cab
xchg edx, eax
outsb dx, byte [esi]
add dword [eax], eax
add byte [eax], al
mov al, byte [0xb0000000]
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ebp + 0x3d], ah
sub bl, byte [ecx + eax + 0x20]
inc esp
inc ebp
inc ecx
inc esp
add byte [eax], al
inc ebp
inc esi
sub eax, 0x46373345
sub eax, 0x72657355
inc ebx
jb 0x403cd0
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x403d03
outsd dx, dword [esi]
insb byte es:[edi], dx
xor dword [eax], eax
xor eax, 0xdf783335
mov edi, 0xf3315da9
dec esi
lodsb al, byte [esi]
loop 0x403c8b
xor esp, dword [ebx - 0x2e9ed419]
retf 0x7b17
jnp 0x403c8b
aam 0xe6
inc ecx
test dword [edx + 0x44902847], eax
adc al, 0x2a
add dword [eax], eax
add eax, dword [eax]
pop eax
inc esi
inc eax
add byte [eax], al
add byte [eax], al
add bh, bh
cmp al, 0x47
inc eax
add byte [ebx + eax*8 + 0x42], dh
add byte [ecx], al
add byte [eax], al
add al, dh
cmp al, 0x40
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, dh
cmp al, 0x40
add byte [edx + 0x10008ea], ah
add byte [eax], al
add byte [eax + 0x46], bl
inc eax
add byte [eax], al
add byte [eax], al
add bh, bh
Function at 0x1000aaa3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1000aab2
pop dword [ebp - 0x2c]
mov eax, 0x1000aab2
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x5bc9405b
add dword [ebp - 0x3c], 0xf28904f0
mov dword [ebp - 0x38], 0x66f59881
add dword [ebp - 0x38], 0xcb3db3c4
mov dword [ebp - 0x34], 0x764b5570
sub dword [ebp - 0x34], 0x29ff1142
mov dword [ebp - 0x30], 0xf7b043cd
add dword [ebp - 0x30], 0x84fbc33
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xef95ce1c
sub eax, 0xdf950df8
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x494b67f
add dword [ebp - 0x3c], 0x6fddb2d7
mov dword [ebp - 0x38], 0x35b62df7
add dword [ebp - 0x38], 0xbb6337e
mov dword [ebp - 0x34], 0x6076ceb0
add dword [ebp - 0x34], 0x2f89dbc
mov dword [ebp - 0x30], 0xb8e8e933
add dword [ebp - 0x30], 0x471716cd
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x92025222
add eax, 0x7dfe6e0a
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3418f
push 0
call eax
mov ecx, 0x3861
mov edx, eax
mov ebx, 0xff386af4
sub ebx, 0xef33f6f4
add ebx, dword [ebp - 0x2c]
mov edi, 0x3ecc1323
sub edi, 0xd99b967e
sub dword [ebp - 4], 0x1435fdb9
mov esi, dword [ebx]
mov dword [ebp - 0x28], 0xf9cbd884
sub esi, edi
xor dword [ebp - 4], 0xc0e24332
mov dword [edx], esi
sub dword [ebp - 0xc], 0x7cd61f79
add edx, 0xd0b309c1
add edx, 0x2f4cf643
add ebx, 0x48d04154
add ebx, 0xb72fbeb0
loop 0x1000abc9
add eax, 0x9aea7097
sub eax, 0x9ae99c40
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x40233f
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x4051f8
call fcn.00402861
push 1
call fcn.004023c2
pop ecx
test al, al
jne 0x4021e8
push 7
call fcn.00402a74
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0040238d
mov byte [ebp - 0x24], al
mov eax, dword [0x40633c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4021e1
test eax, eax
jne 0x402252
mov dword [0x40633c], ecx
push 0x40429c
push 0x404284
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x402235
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x402339
push 0x404280
push 0x40426c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x40633c], 2
jmp 0x402257
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0040251f
pop ecx
call fcn.00402a68
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x402287
push esi
call fcn.00402492
pop ecx
test al, al
je 0x402287
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00402ca3
call esi
call fcn.00402a6e
mov esi, eax
cmp dword [esi], edi
je 0x4022a5
push esi
call fcn.00402492
pop ecx
test al, al
je 0x4022a5
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.00402b89
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.00402bbc
test al, al
jne 0x4022de
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x4022e7
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0040253c
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x402339
call fcn.004028a7
ret
call fcn.00402059
jmp 0x4021c9

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x23ca5964
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..pdata
nop
nop
nop
nop
cmp eax, 0
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x33c92a84
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219