joyce8/EMBER2024-capa huggingface dataset:
Function at 0x75172c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [0x7687e8]
mov eax, dword [eax]
xor edx, edx
call fcn.005ee094
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x45c], edx
mov eax, dword [0x768ed0]
cmp dword [eax], 0
je 0x75176a
mov eax, dword [0x768ed0]
mov eax, dword [eax]
call fcn.00561a1c
jmp 0x7518da
mov eax, dword [ebp - 4]
cmp byte [eax + 0x45a], 0
je 0x751785
mov eax, 0x7518ec
call fcn.00712c38
jmp 0x7518da
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x744c44]
call fcn.005ed004
mov edx, dword [0x768ed0]
mov dword [edx], eax
xor eax, eax
push ebp
push 0x7518d3
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [ebp - 4]
call fcn.0056a620
push eax
call sub.user32.dll_ShowWindow
cmp bl, 1
jne 0x7517e3
mov eax, dword [0x768ed0]
mov eax, dword [eax]
mov edx, dword [eax + 0x3b8]
mov eax, dword [0x768ed0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b0]
mov ecx, dword [eax]
call dword [ecx + 0x220]
jmp 0x75182e
cmp bl, 2
jne 0x75180c
mov eax, dword [0x768ed0]
mov eax, dword [eax]
mov edx, dword [eax + 0x3f8]
mov eax, dword [0x768ed0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b0]
mov ecx, dword [eax]
call dword [ecx + 0x220]
jmp 0x75182e
mov eax, dword [0x768ed0]
mov eax, dword [eax]
mov edx, dword [eax + 0x3b4]
mov eax, dword [0x768ed0]
mov eax, dword [eax]
mov eax, dword [eax + 0x3b0]
mov ecx, dword [eax]
call dword [ecx + 0x220]
mov eax, dword [0x768ed0]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x128]
mov eax, dword [0x768ed0]
mov eax, dword [eax]
cmp dword [eax + 0x2d8], 1
jne 0x751869
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x454]
call fcn.0073a1b0
test al, al
jne 0x751869
mov eax, 0x75195c
call fcn.00712c38
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x454]
call fcn.0073a7f4
mov eax, dword [0x7687e8]
mov eax, dword [eax]
call fcn.0074c414
mov eax, dword [ebp - 4]
call fcn.0074f650
mov eax, dword [ebp - 4]
call fcn.0074f510
mov eax, dword [ebp - 4]
call fcn.0074fc94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7518da
push 0
mov eax, dword [ebp - 4]
call fcn.0056a620
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x768ed0]
mov eax, dword [eax]
call fcn.00407bf8
mov eax, dword [0x768ed0]
xor edx, edx
mov dword [eax], edx
call fcn.007161e8
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x100024be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x100024cd
pop dword [ebp - 0x18]
mov eax, 0x100024cd
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xc35c210b
add dword [ebp - 0x28], 0x8af62440
mov dword [ebp - 0x24], 0x4cd8cb4b
add dword [ebp - 0x24], 0xe55a80fa
mov dword [ebp - 0x20], 0xac6e3dd2
sub dword [ebp - 0x20], 0x6021f9a4
mov dword [ebp - 0x1c], 0xa0b26140
sub dword [ebp - 0x1c], 0xa0b26140
lea eax, [ebp - 0x28]
push eax
mov eax, 0x428f4dc3
sub eax, 0x328f0d7b
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xcbddc148
sub dword [ebp - 0x28], 0x576b57f2
mov dword [ebp - 0x24], 0x316c1b26
add dword [ebp - 0x24], 0x1000464f
mov dword [ebp - 0x20], 0x2cbf8a17
sub dword [ebp - 0x20], 0xc9501dab
mov dword [ebp - 0x1c], 0xb1b402b0
add dword [ebp - 0x1c], 0x4e4bfd50
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x36d1f
push 0
call eax
mov ecx, 0x4912
mov ebx, eax
mov edi, 0x79840fc4
add edi, 0x967c863c
add edi, dword [ebp - 0x18]
mov edx, 0x8be81f16
add dword [ebp - 0x10], esi
mov esi, dword [edi]
xor dword [ebp - 0x10], 0xb346c9da
sub esi, edx
mov dword [ebp - 0x14], 0xa567fc37
mov dword [ebx], esi
xor dword [ebp - 0x10], 0x6513a331
add ebx, 0xc8be2bba
sub ebx, 0xc8be2bb6
add edi, 4
loop 0x100025d9
add eax, 0x1171b
mov ebx, eax
add eax, 0xdcb698ae
sub eax, 0xdcb698a9
mov ecx, 0x98252da1
sub ecx, 0x88252da1
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x100032c8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10007040]
jne 0x100032d2
repz ret
jmp fcn.100036ab

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4a4a4b06
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..tls
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3f296f14
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x40377f
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x420030]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.advapi32.dll_RegEnumKeyA]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x6c]
push ecx
xor ebx, ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xa8]
push ebx
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], ebx
call edi
test eax, eax
jne 0x403822
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
inc dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push eax
call fcn.00404ece
pop ecx
pop ecx
test eax, eax
je 0x40380b
test ebx, ebx
je 0x4037ff
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.00404ece
pop ecx
pop ecx
test eax, eax
jle 0x40380b
push ebx
call fcn.0040473f
pop ecx
lea eax, [ebp - 0x6c]
push eax
call fcn.0040471e
pop ecx
mov ebx, eax
push esi
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x4037cc
xor edi, edi
cmp ebx, edi
jne 0x403826
xor eax, eax
jmp 0x403892
lea eax, [ebp - 0x70]
push eax
push 0x20019
push edi
push ebx
push dword [ebp - 0x78]
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push ebx
test eax, eax
je 0x403855
call fcn.0040473f
pop ecx
cmp dword [ebp - 0x70], edi
je 0x403822
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x403822
call fcn.0040473f
pop ecx
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push edi
push str.JavaHome
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x403845
cmp dword [ebp - 0x70], edi
je 0x403888
push dword [ebp - 0x70]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [ebp - 0x6c]
push eax
call fcn.0040471e
pop ecx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004088d9
add ebp, 0x9c
leave
ret
Function at 0x404934
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x214]
sub esp, 0x294
mov eax, dword [0x420030]
xor eax, ebp
mov dword [ebp + 0x210], eax
mov eax, dword [ebp + 0x21c]
push ebx
push esi
push edi
push 0x10
pop edi
mov dword [ebp - 0x78], eax
call fcn.004047a1
push 8
mov esi, eax
call fcn.004046d7
mov ebx, eax
pop ecx
lea eax, [ebp + 0xd0]
push eax
push dword [ebp - 0x78]
mov dword [ebp - 0x80], ebx
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40499f
mov dword [ebx], eax
lea eax, [ebp + 0xfc]
mov dword [ebx + 4], eax
mov edi, dword [ebx + 4]
test edi, edi
je 0x4049a6
and dword [ebx + 4], 0
jmp 0x4049bb
xor eax, eax
jmp 0x404a86
lea eax, [ebp - 0x70]
push eax
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindNextFileA]
neg eax
sbb edi, edi
lea eax, [ebp - 0x44]
and edi, eax
test edi, edi
je 0x404a6c
push edi
call fcn.00408090
pop ecx
cmp eax, 4
jl 0x404992
add eax, edi
cmp byte [eax - 4], 0x2e
jne 0x404992
add eax, 0xfffffffd
push 0x4197b4
push eax
mov dword [ebp - 0x74], eax
call fcn.004088f0
pop ecx
pop ecx
test eax, eax
je 0x404a01
push 0x4197b0
push dword [ebp - 0x74]
call fcn.004088f0
pop ecx
pop ecx
test eax, eax
jne 0x404992
push 0x3b
push edi
call fcn.004097a0
pop ecx
pop ecx
test eax, eax
jne 0x404992
push dword [ebp - 0x78]
call fcn.00408090
push edi
mov ebx, eax
call fcn.00408090
mov dword [ebp - 0x74], eax
add eax, ebx
push eax
call fcn.004046d7
lea ecx, [ebx - 1]
push ecx
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], eax
push eax
call fcn.00404ece
mov eax, dword [ebp - 0x74]
inc eax
push eax
push edi
mov edi, dword [ebp - 0x7c]
lea eax, [edi + ebx - 1]
push eax
call fcn.00404ece
mov ecx, dword [esi + 4]
add esp, 0x24
inc ecx
call fcn.004047f7
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov ebx, dword [ebp - 0x80]
mov dword [ecx + eax*4], edi
inc dword [esi + 4]
jmp 0x404992
push dword [ebx]
call dword [sym.imp.kernel32.dll_FindClose]
push dword [ebx + 4]
call fcn.0040473f
push ebx
call fcn.0040473f
pop ecx
pop ecx
mov eax, esi
mov ecx, dword [ebp + 0x210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004088d9
add ebp, 0x214
leave
ret
Function at 0x404ece
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x404edd
pop dword [ebp - 0x44]
mov eax, 0x404edd
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x1d732802
add dword [ebp - 0x54], 0x30df1d49
mov dword [ebp - 0x50], 0x708417fd
add dword [ebp - 0x50], 0xc1af3448
mov dword [ebp - 0x4c], 0xb10b5bdb
add dword [ebp - 0x4c], 0x9b40e853
mov dword [ebp - 0x48], 0x5f13bd12
sub dword [ebp - 0x48], 0x5f13bd12
lea eax, [ebp - 0x54]
push eax
mov eax, 0xb23c779e
add eax, 0x4e0508b2
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xb168c0ba
sub dword [ebp - 0x54], 0x3cf65764
mov dword [ebp - 0x50], 0x7cb45f6b
sub dword [ebp - 0x50], 0x3b47fdf6
mov dword [ebp - 0x4c], 0xeb6c2809
add dword [ebp - 0x4c], 0x78034463
mov dword [ebp - 0x48], 0xd72aa2c6
sub dword [ebp - 0x48], 0xd72aa2c6
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xaa339616
add eax, 0x560dea36
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3efca
push 0
call eax
mov ecx, 0xb7ffe90e
sub ecx, 0xb7ff92bf
mov esi, eax
mov edx, 0x531988
add edx, 0xffefce78
add edx, dword [ebp - 0x44]
mov ebx, 0x22fd830f
add ebx, 0xb38307fa
xor dword [ebp - 4], 0x890f3c40
mov edi, dword [edx]
add dword [ebp - 0x1c], edx
add edi, ebx
xor dword [ebp - 0x28], 0x604d7114
mov dword [esi], edi
add dword [ebp - 0x28], 0xc3917573
add esi, 0x89fe5a19
add esi, 0x7601a5eb
add edx, 4
loop 0x404ffa
add eax, 0xb42bee14
sub eax, 0xb42aa205
mov ebx, eax
add eax, 5
mov ecx, 0x4fcc2bc9
add ecx, 0xb073d437
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x4088d9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420030]
jne 0x4088e3
repz ret
jmp fcn.00410778
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x401c66
pop dword [ebp - 0x30]
mov eax, 0xf7df2770
sub eax, 0xf79f0b0a
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x2b907068
add dword [ebp - 0x40], 0x22c1d4e3
mov dword [ebp - 0x3c], 0x5145ff1d
add dword [ebp - 0x3c], 0xe0ed4d28
mov dword [ebp - 0x38], 0xb054efb6
sub dword [ebp - 0x38], 0x6408ab88
mov dword [ebp - 0x34], 0x7685b44
sub dword [ebp - 0x34], 0x7685b44
lea eax, [ebp - 0x40]
push eax
mov eax, 0x466255f5
add eax, 0xb9ddda5f
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x2d2d642d
sub dword [ebp - 0x40], 0xb8bafad7
mov dword [ebp - 0x3c], 0x65e561a3
add dword [ebp - 0x3c], 0xdb86ffd2
mov dword [ebp - 0x38], 0xba3391
sub dword [ebp - 0x38], 0x9d4ac725
mov dword [ebp - 0x34], 0x754abd60
sub dword [ebp - 0x34], 0x754abd60
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x32cbe
push 0
call eax
mov ecx, 0x3943
xor esi, esi
add esi, eax
mov edx, 0x515cab4a
add edx, 0xaee3c4b6
add edx, dword [ebp - 0x30]
mov ebx, 0x1028b393
sub ebx, 0x69bb24f5
sub dword [ebp - 0x20], edx
mov edi, dword [edx]
sub edi, ebx
xor dword [ebp - 0x28], 0xfa2b1a52
mov dword [esi], edi
sub dword [ebp - 0x2c], 0x3645c21b
add esi, 0x796ac7b8
add esi, 0x8695384c
add edx, 0x289eed1d
sub edx, 0x289eed19
loop 0x401d7f
add eax, 0x9d73bae0
add eax, 0x628d1cff
mov ebx, eax
add eax, 0x4b003c8b
sub eax, 0x4b003c86
mov ecx, 0x5c1c3a34
add ecx, 0xa423c5cc
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x485ac0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5c000]
push edi
or ebp, 0xffffffff
jmp 0x485ae2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x485ae9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x485ad8
mov eax, 1
add ebx, ebx
jne 0x485afb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x485b0c
jne 0x485b2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x485b2b
dec eax
add ebx, ebx
jne 0x485b18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x485af0
add ebx, ebx
jne 0x485b27
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x485b7d
xor ecx, ecx
sub eax, 3
jb 0x485b43
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x485bb2
sar eax, 1
mov ebp, eax
jmp 0x485b4e
add ebx, ebx
jne 0x485b4e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x485b1c
inc ecx
add ebx, ebx
jne 0x485b5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x485b1c
add ebx, ebx
jne 0x485b69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x485b5e
jne 0x485b7a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x485b5e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x485b9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x485b8e
jmp 0x485ade
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x485b9c
add edi, ecx
jmp 0x485ade
pop esi
mov edi, esi
mov ecx, 0x946
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x485bba
cmp byte [edi], 0x11
jne 0x485bba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x485bbf
lea edi, [esi + 0x82000]
mov eax, dword [edi]
or eax, eax
je 0x485c37
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9e218]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9e2d4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x485bec
mov ecx, edi
jns 0x485c1b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9e2dc]
or eax, eax
je 0x485c31
mov dword [ebx], eax
add ebx, 4
jmp 0x485c09
call dword [esi + 0x9e2d8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x485c68
cmp al, 0xef
ja 0x485c5b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x485c3d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x485c4a
mov ebp, dword [esi + 0x9e2e0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x485c9c
sub esp, 0xffffff80
jmp 0x404ff7
Function at 0x1002a8d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp + 0x14]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp + 0x14], esi
push dword [ebp + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1002ae8
mov eax, dword [ebp + 0x14]
cmp eax, 2
jb 0x1002ae3
shr eax, 1
xor ecx, ecx
cmp cx, word [edi + eax*2 - 2]
jne 0x1002ae3
mov eax, dword [ebp + 0x10]
dec eax
je 0x1002adf
dec eax
jne 0x1002ae3
push esi
push edi
call fcn.01002996
test eax, eax
jne 0x1002ae8
xor eax, eax
jmp 0x1002ae8
mov eax, 0x3f7
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x1002d87
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1003220
call fcn.01002f44
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10043c8
push ebx
push esi
push edi
call dword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1002b9c
cmp eax, esi
jne 0x1002b8f
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1002b9f
push 0x3e8
call dword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
jmp 0x1002b76
xor esi, esi
inc esi
mov eax, dword [0x10043c4]
cmp eax, esi
jne 0x1002bb2
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1002bed
mov eax, dword [0x10043c4]
test eax, eax
jne 0x1002be7
mov dword [0x10043c4], esi
push 0x1001188
push 0x100117c
call fcn.01002af3
pop ecx
pop ecx
test eax, eax
je 0x1002bed
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1002cb7
mov dword [0x1004078], esi
mov eax, dword [0x10043c4]
cmp eax, esi
jne 0x1002c11
push 0x1001178
push 0x1001170
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10043c4], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1002c1e
push ebx
push edi
call dword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedExchange]
cmp dword [0x10043cc], ebx
je 0x1002c3f
push 0x10043cc
call fcn.01002eb9
pop ecx
test eax, eax
je 0x1002c3f
push ebx
push 2
push ebx
call dword [0x10043cc]
push dword [0x1004060]
push dword [0x1004064]
push dword [0x100405c]
call fcn.010018dc
add esp, 0xc
mov dword [0x1004074], eax
cmp dword [0x1004068], ebx
jne 0x1002c9d
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1004078], ebx
jne 0x1002cab
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1004074]
call fcn.01002f89
ret
call fcn.01003091
jmp 0x1002b54
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x43eb65ba
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x67795127
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10001c71
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002b4ac
call fcn.1002a0c8
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
xor ebx, ebx
mov ecx, edi
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
call fcn.10002a03
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], 1
mov dword [ebp - 4], ebx
cmp byte [0x1003cde0], bl
je 0x10001cea
cmp dword [edi + 0x14], 0x10
jb 0x10001cc6
mov edi, dword [edi]
push edi
push str.CMemMappedFile__s__ctor__reference_
mov edi, 0x1003c7f0
push edi
call fcn.100220a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10001cea
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push esi
call fcn.100220a0
pop ecx
mov eax, esi
call fcn.1002a091
ret 8

Function at 0x10001cfb
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002b4ac
call fcn.1002a0c8
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
push edi
call fcn.100026c3
pop ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ecx
mov byte [esi + 0x30], cl
mov dword [ebp - 4], ecx
cmp byte [0x1003cde0], cl
je 0x10001d6b
cmp dword [edi + 0x14], 0x10
jb 0x10001d46
mov edi, dword [edi]
push eax
push edi
push str.CMemMappedFile__s__ctor__new_with_size_lu_
mov edi, 0x1003c7f0
push edi
call fcn.100220a0
add esp, 0x10
cmp byte [0x1003cde0], 0
je 0x10001d6b
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov ecx, esi
call fcn.100031a0
mov eax, esi
call fcn.1002a091
ret 4

Function at 0x10001d7c
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002b4ac
call fcn.1002a0c8
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
push edi
call fcn.100026c3
pop ecx
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov dword [ebp - 4], eax
cmp byte [0x1003cde0], al
je 0x10001de8
cmp dword [edi + 0x14], 0x10
jb 0x10001dc4
mov edi, dword [edi]
push edi
push str.CMemMappedFile__s__ctor__new_
mov edi, 0x1003c7f0
push edi
call fcn.100220a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10001de8
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov eax, esi
call fcn.1002a091
ret