joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4058f3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405964
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x2000
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405953
cmp dword [ebp + 0x14], 1
je 0x405955
cmp dword [ebp + 0x14], 2
je 0x405955
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x1fff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x756fb5
Function at 0x437584
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x4375d0
mov eax, esi
call fcn.0044d0b8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4375d0
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x4375d0
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x43770f
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x437610
cmp eax, 0x108
ja 0x437610
mov eax, esi
call fcn.0044d0b8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x437706
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xec]
test al, al
jne 0x43770f
jmp 0x437706
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x4376ef
cmp eax, 0x20a
ja 0x4376ef
test byte [esi + 0x50], 0x80
jne 0x437642
sub eax, 0x203
je 0x43763f
sub eax, 3
je 0x43763f
sub eax, 3
jne 0x437642
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x437656
dec eax
je 0x43766b
dec eax
je 0x437688
dec eax
je 0x43766b
jmp 0x43768f
mov ecx, ebx
mov eax, dword [0x464834]
mov eax, dword [eax]
mov edx, esi
call fcn.004565e8
jmp 0x437706
cmp byte [esi + 0x5d], 1
jne 0x437681
mov eax, esi
mov si, 0xffed
call fcn.00403ba4
jmp 0x43770f
or word [esi + 0x54], 1
jmp 0x437706
and word [esi + 0x54], 0xfffe
jmp 0x437706
mov eax, dword [0x467d88]
cmp byte [eax + 0x20], 0
je 0x437706
mov eax, dword [0x467d88]
cmp dword [eax + 0x1c], 0
je 0x437706
mov eax, dword [ebx]
mov edx, dword [0x467d88]
cmp eax, dword [edx + 0x1c]
jne 0x437706
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.0044cffc
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.00403ba4
jmp 0x43770f
cmp eax, 0xb00b
jne 0x437706
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.00435eb4
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43abe0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x43abfc
cmp dword [esi + 4], 0
je 0x43ac29
test byte [ebx + 0x55], 1
jne 0x43ac1b
mov eax, ebx
call fcn.0043981c
test eax, eax
jne 0x43ac1b
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x43ad39
mov edx, esi
mov eax, ebx
call fcn.0043a700
jmp 0x43ad39
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x43ad32
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043c9e8
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.004374b8
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.0043abe0
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0043c9e8
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ad39
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4410c4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4649a8]
cmp byte [eax + 0xc], 0
je 0x441231
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44122a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x467ddc], 0
jne 0x441118
push 0x441238
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x441240
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467ddc], eax
cmp dword [0x4641dc], 0
jne 0x441213
push 0x441250
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4641dc], eax
cmp dword [0x4641dc], 0
je 0x441213
push 0x44125c
mov eax, dword [0x4641dc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467de0], eax
push 0x44126c
mov eax, dword [0x4641dc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467de4], eax
push 0x441280
mov eax, dword [0x4641dc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467de8], eax
push 0x441298
mov eax, dword [0x4641dc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467dec], eax
push 0x4412b0
mov eax, dword [0x4641dc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467df0], eax
push 0x4412c4
mov eax, dword [0x4641dc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467df4], eax
push 0x4412dc
mov eax, dword [0x4641dc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467df8], eax
push 0x4412f4
mov eax, dword [0x4641dc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467dfc], eax
push 0x441310
mov eax, dword [0x4641dc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467e00], eax
push 0x44131c
mov eax, dword [0x4641dc]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x467e04], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x441231
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x444f94
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404714
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x444fe3
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.0040497c
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4454a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x44549f
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
shr dword [eax], 0x4a
jne 0x445490
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0044524b
push es
sbb cl, byte [esi - 0x29]
lea eax, [ebp - 0x58]
push eax
call fcn.0044525b
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00445210
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x445539
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0044524b
mov byte [0x8d99f4c2], al
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x445934
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x445922
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x445940
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
add byte [eax], al
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x44599e
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x445985
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x44598e
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x445998
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x44597a
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x445904
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4459eb
dec eax
je 0x4459e2
sub eax, 3
je 0x4459d9
mov dword [ebp - 4], 0x40
jmp 0x445a08
mov dword [ebp - 4], 4
jmp 0x4459ee
mov dword [ebp - 4], 0x20
jmp 0x4459ee
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x445a3a
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4459ba
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0044524b
imul eax, dword [ebp + 0x75ffdd8e], 0x56016a14
call edi
mov eax, esi
jmp 0x445a46
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x445a64
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax - 0x3525b], al
inc dword [eax]
mov byte [ebp - 0x352], 0xda
and byte [ebp - 0x351], 0
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0044525b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00445210
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0044525b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00445210
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.0044525b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00445210
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.0044524b
int3
Function at 0x445f14
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xc6fffffc
test dword [edx + edi*8 - 0x7cfe0001], edi
mov ebp, 0xfffffc68
add byte [edi + edx - 0x7d], dh
mov ebp, 0xfffffc68
add byte [edi], cl
test ah, dl
add dword [eax], eax
add byte [ebx + 0xf010c7d], al
test dl, cl
add dword [eax], eax
add byte [ebx + 0xf080c7d], al
test dword [eax - 0x7fffffff], ecx
movsd dword es:[edi], dword [esi]
dec eax
stc
invalid

Function at 0x44cf6c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44cfbc]
test si, 4
je 0x44cf80
or bl, 1
test si, 8
je 0x44cf8a
or bl, 4
test si, 1
je 0x44cf94
or bl, 8
test si, 2
je 0x44cf9e
or bl, 0x10
test si, 0x10
je 0x44cfa8
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44cfb7
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x44cfc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44cff8]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44cfd9
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44cfe8
or bl, 4
test esi, 0x20000000
je 0x44cff3
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4537f4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x453806
add esp, 0xfffffff0
call fcn.00403d0c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00421f34
mov eax, dword [0x464690]
mov dword [eax + 4], ebx
mov dword [eax], 0x453b98
mov eax, dword [0x46469c]
mov dword [eax + 4], ebx
mov dword [eax], 0x453ba4
mov eax, ebx
call fcn.00453bb0
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x417ed8]
call fcn.00403978
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x417ed8]
call fcn.00403978
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x417ed8]
call fcn.00403978
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x417ed8]
call fcn.00403978
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x417ed8]
call fcn.00403978
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44fecc
push eax
push 0
push 0
mov eax, dword [0x4647c0]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4238f4]
call fcn.00425030
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4238f4]
call fcn.00425030
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4238f4]
call fcn.00425030
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00453fd0
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x453eac
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x453eac
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x453eac
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x453943
call fcn.00403d64
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x420860
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 0x124
push ebx
push ebp
push esi
push edi
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x3c]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov ecx, 0xa
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x138]
lea eax, [esp + 0x3c]
push eax
push ecx
mov dword [esp + 0x18], ebx
xor esi, esi
call fcn.00420cd0
add eax, 4
movsx edx, word [esp + 0x50]
jo 0x4209b6
add eax, 0x14
jo 0x4209b6
add eax, edx
jo 0x4209b6
mov edi, eax
mov ax, word [esp + 0x42]
sub ax, 1
jo 0x4209b6
movsx ebp, ax
cmp ebp, ebx
jl 0x4209a7
lea ecx, [esp + 0x14]
push ecx
call fcn.004210b0
push 0x28
push edi
push eax
call fcn.00421000
mov eax, dword [esp + 0x38]
test eax, 0x20000000
je 0x42091e
test eax, 0x40000000
je 0x42090d
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 0x20
add eax, 0x20
jmp 0x420943
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 0x70
add eax, 0x10
jmp 0x420943
test eax, 0x40000000
je 0x420936
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 2
add eax, 2
jmp 0x420943
and eax, 0x80000000
neg eax
sbb eax, eax
and eax, 7
inc eax
lea edx, [esp + 0x10]
mov esi, eax
push edx
call fcn.004210b0
push eax
push esi
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x140]
mov eax, dword [esp + 0x24]
add ecx, esi
push eax
jo 0x4209b6
push ecx
call fcn.00420fe0
test eax, eax
je 0x420990
add edi, 0x28
jo 0x4209b6
add ebx, 1
jo 0x4209b6
cmp ebx, ebp
jle 0x4208d7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x124
ret 4
mov esi, 4
call dword [sym.imp.KERNEL32.DLL_SetFileApisToANSI]
call dword [sym.imp.KERNEL32.DLL_SetFileApisToOEM]
call dword [sym.imp.USER32.DLL_WaitMessage]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop

Function at 0x414dd9
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor dword [esi], edi
sub ebx, ecx
push ebx
pop ecx
add esi, 4
mov ecx, 0xb916d9b7
cmp esi, eax
jne fcn.00414dd9
or ecx, edx
sub ecx, 0x3070627d
ret
Function at 0x403358
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00405530
test esi, esi
jne 0x40338e
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00405620
jmp 0x4033ac
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004031fc
mov edi, eax
test esi, esi
je 0x4033ac
cmp dword [ebx], 0
je 0x4033ac
dec esi
jmp 0x403395
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4033e0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x491008], 0x8088405
inc edx
mov dword [ebx + 0x491008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x404448
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x491024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4044e0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4044c0
xor eax, eax
push ebp
push 0x4044b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4044fc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4044c0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
movzx eax, word [0x491024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x491024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4052fc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x49504c], 0
je 0x40535d
cmp word [0x495220], 0xd7b2
jne 0x405325
cmp dword [0x495228], 0
jbe 0x405325
mov eax, 0x49521c
call dword [0x495238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405384
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
pop edx
ret
cmp byte [0x491030], 0
jne 0x405379
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA_1
pop edx
ret

Function at 0x4054b4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x491038], 0
je 0x4054da
mov edx, esi
mov eax, ebx
call dword [0x491038]
jmp 0x4054e9
mov eax, 8
call fcn.00402f00
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x49504d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x40547c
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.KERNEL32.DLL_CreateThread_1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc