joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d7ee0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4d7f13
push esi
call fcn.004e6120
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4d7f0c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x4d7f99
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4d7f82
mov eax, dword [esi + 8]
test eax, eax
je 0x4d7f37
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x4d7f7e
cmp eax, 2
je 0x4d7f82
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4d7f2a
cmp eax, 3
je 0x4d7f5d
cmp eax, 1
jne 0x4d7f2a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4d7f2a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4d7f2a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004d7fc0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x4d7fa8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004d7fc0
add esp, 4
pop esi
ret

Function at 0x4d8830
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x4d8851
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x4d8851
mov eax, dword [eax + 0x44]
test eax, eax
je 0x4d8851
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4f50e0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
xor ecx, ecx
push esi
push edi
mov eax, dword [ebp]
mov edi, dword [ebp + 4]
mov dword [esp + 0x24], edi
mov dword [esp + 0x10], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebx, [ecx + eax + 0x18]
jbe 0x4f51e3
add ebx, 0x10
mov eax, dword [ebx]
test eax, eax
jne 0x4f5166
mov edx, dword [esp + 0x20]
mov esi, dword [edx + 0x38]
test esi, esi
jle 0x4f51c6
mov eax, dword [ebp + 0x34]
mov edx, dword [ebx - 4]
push eax
mov ecx, edi
push 4
push 0x1000
add ecx, edx
push esi
push ecx
call dword [ebp + 0x1c]
add esp, 0x14
test eax, eax
je 0x4f51ee
mov eax, dword [ebx - 4]
mov ecx, esi
mov edx, ecx
add edi, eax
xor eax, eax
mov dword [ebx - 8], edi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x4f51c2
mov ecx, dword [ebx + 4]
mov edx, dword [esp + 0x1c]
add ecx, eax
push ecx
push edx
call fcn.004f50c0
add esp, 8
test eax, eax
je 0x4f51ee
mov eax, dword [ebp + 0x34]
mov ecx, dword [ebx]
push eax
mov eax, dword [ebx - 4]
mov edx, edi
push 4
push 0x1000
add edx, eax
push ecx
push edx
call dword [ebp + 0x1c]
add esp, 0x14
test eax, eax
je 0x4f51ee
mov ecx, dword [ebx - 4]
mov esi, dword [ebx + 4]
mov eax, edi
mov edi, dword [esp + 0x18]
add eax, ecx
mov ecx, dword [ebx]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx - 8], eax
mov edi, dword [esp + 0x24]
mov ecx, dword [ebp]
mov eax, dword [esp + 0x10]
xor edx, edx
inc eax
mov dx, word [ecx + 6]
add ebx, 0x28
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x4f5113
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x4f5200
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
xor ecx, ecx
mov eax, dword [edi]
mov cx, word [eax + 0x14]
lea esi, [ecx + eax + 0x18]
mov ecx, dword [edi + 0x3c]
push ecx
mov eax, dword [esi + 8]
push eax
mov dword [esp + 0x1c], eax
call fcn.004f5350
push esi
push edi
mov dword [esp + 0x28], eax
call fcn.004f5360
mov ecx, dword [edi]
mov dword [esp + 0x2c], eax
mov edx, dword [esi + 0x24]
mov eax, 1
add esp, 0x10
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 0
add esi, 0x28
cmp word [ecx + 6], ax
mov dword [esp + 0x10], eax
jbe 0x4f531b
mov ecx, dword [edi + 0x3c]
mov eax, dword [esi + 8]
push ecx
push eax
mov dword [esp + 0x34], eax
call fcn.004f5350
push esi
push edi
mov ebx, eax
call fcn.004f5360
mov edx, dword [esp + 0x24]
mov ebp, eax
mov eax, dword [esp + 0x28]
add esp, 0x10
cmp eax, ebx
je 0x4f52c5
mov eax, dword [esp + 0x1c]
add eax, edx
cmp eax, ebx
ja 0x4f52c5
lea ecx, [esp + 0x14]
push ecx
push edi
call fcn.004f5390
add esp, 8
test eax, eax
je 0x4f533b
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], ebp
mov eax, dword [esi + 0x24]
mov dword [esp + 0x20], eax
jmp 0x4f52fa
mov eax, dword [esi + 0x24]
mov ecx, dword [esp + 0x20]
test eax, 0x2000000
je 0x4f52e3
test ecx, 0x2000000
je 0x4f52e3
or ecx, eax
mov dword [esp + 0x20], ecx
jmp 0x4f52ee
or eax, ecx
and eax, 0xfdffffff
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
sub ebp, edx
add ebp, eax
mov dword [esp + 0x1c], ebp
mov ecx, dword [edi]
mov eax, dword [esp + 0x10]
xor edx, edx
inc eax
mov dx, word [ecx + 6]
add esi, 0x28
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x4f5261
mov eax, 1
mov dword [esp + 0x24], eax
lea eax, [esp + 0x14]
push eax
push edi
call fcn.004f5390
add esp, 8
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x18
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret

Function at 0x4fa7a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4fa806
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4fa806
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x4fa7e7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x4fab90
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4fabc8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x4fb850
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4fb899
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x4fbd10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x536d00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004fb8c0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004fb940
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004fb940
lea ecx, [esi + 0xc]
call fcn.00527c1c
lea ecx, [esi + 0x10]
call fcn.00527c1c
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004fced0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004fced0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004fced0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00527c91
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00527c91
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4fffc0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xf4d1e8
push 0x5189e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
rdtsc
mov esi, eax
mov edi, edx
call ebx
rdtsc
pop ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0xffffffff
xor esi, esi
mov edi, dword [ebp - 0x20]
push 1
push esi
push esi
mov eax, dword [ebp - 0x28]
push eax
call fcn.00516860
sub eax, esi
sbb edx, edi
mov ecx, dword [ebp - 0x1c]
sub eax, ecx
sbb edx, esi
mov ecx, dword [ebp - 0x24]
add eax, ecx
adc edx, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x500170
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x9c
push eax
call esi
test eax, eax
jne 0x5001b1
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x94
push ecx
call esi
test eax, eax
je 0x50021e
cmp dword [esp + 0x1c], 2
jne 0x50021e
cmp dword [esp + 0x10], 5
jne 0x50021e
cmp dword [esp + 0x14], 1
jne 0x50021e
push str.kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x500208
push str.IsWow64Process
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x5001f9
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
jmp 0x500201
mov dword [esp + 8], 0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 8]
test eax, eax
je 0x50021e
pop edi
mov eax, 1
pop esi
add esp, 0xa0
ret
pop edi
xor eax, eax
pop esi
add esp, 0xa0
ret

Function at 0x501a40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x537158
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00501620
mov eax, dword [esp + 0x24]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x20], 0
call fcn.00501690
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
push edx
lea ecx, [esp + 0xc]
push eax
push ecx
mov ecx, esi
call fcn.00501970
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.00501640
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x501a58
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x537158
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00501620
mov eax, dword [esp + 0x24]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x20], 0
call fcn.00501690
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
push edx
lea ecx, [esp + 0xc]
push eax
push ecx
mov ecx, esi
call fcn.00501970
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.00501640
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10
Function at 0x5043d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x5043db
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x5044de
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0xf4ec7c]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0xf4ec7c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0xf4ec7c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0xf4ec7c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0xf4ec7c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0xf4ec7c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0xf4ec7c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0xf4ec7c]
xor eax, edx
inc ecx
dec edi
jne 0x5043f6
pop edi
test esi, esi
je 0x504500
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0xf4ec7c]
xor eax, edx
inc ecx
dec esi
jne 0x5044e2
pop esi
pop ebx
not eax
ret

Function at 0x504d10
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
mov cl, byte [ebx]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x504d51
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x504d46
mov byte [ebx + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
push esi
push edi
lea esi, [edx + eax]
cmp esi, ecx
jbe 0x504d64
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x10]
mov edi, dword [esp + 0x14]
mov ecx, eax
add esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x18]
pop edi
add ecx, eax
pop esi
div ebp
mov dword [ebx + 0x18], ecx
pop ebp
pop ebx
ret
Function at 0x518d7d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x518d9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00517e9a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x518dc0
test byte [esp + 8], 2
je 0x518dc0
call fcn.00517f0d
mov dword [eax], 0xd
call fcn.00517f16
mov dword [eax], 5
jmp 0x518d99
xor eax, eax
ret

Function at 0x52a05f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x52a097
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005280ec
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005280c4
jmp 0x52a0a3
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x52b751
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x52b793
call fcn.005314cf
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x52b793
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x52b78a
xor eax, eax
jmp 0x52b79b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0052b7a1
pop edi
pop esi
pop ebx
ret 4

Function at 0x5319ff
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x531a2d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x531a4b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00531965
jmp 0x531a4b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x531a4b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00531965
test edi, edi
mov eax, edi
jne 0x531a35
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x406c76
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x406c85
pop dword [ebp - 0xc]
mov eax, 0xedf263f
add eax, 0xf1614646
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xa88ea872
sub dword [ebp - 0x1c], 0x5a3c6327
mov dword [ebp - 0x18], 0x5a8d0771
sub dword [ebp - 0x18], 0x2859bb2c
mov dword [ebp - 0x14], 0x224802fd
sub dword [ebp - 0x14], 0xd5fbbecf
mov dword [ebp - 0x10], 0xcd1dab58
add dword [ebp - 0x10], 0x32e254a8
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x70bfd37c
add eax, 0x8f803cb0
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xc8eee9a8
add dword [ebp - 0x1c], 0xab837fae
mov dword [ebp - 0x18], 0x11fc1d80
add dword [ebp - 0x18], 0x2f7043f5
mov dword [ebp - 0x14], 0x5c6faaf3
sub dword [ebp - 0x14], 0xf9003e87
mov dword [ebp - 0x10], 0xcea8e441
sub dword [ebp - 0x10], 0xcea8e441
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3cf4d
push 0
call eax
mov ecx, 0xc37ac28e
sub ecx, 0xc37a72ef
xor ebx, ebx
add ebx, eax
mov edx, 0x36da89c8
sub edx, 0x36995fc8
add edx, dword [ebp - 0xc]
mov edi, 0xcbf3a61f
add edi, 0x4f058a41
mov dword [ebp - 4], 0xc1de4cc8
mov esi, dword [edx]
xor dword [ebp - 4], ecx
sub esi, edi
xor dword [ebp - 4], 0xc8cb89e6
mov dword [ebx], esi
add dword [ebp - 4], 0x96e3067d
add ebx, 0xded9716d
sub ebx, 0xded97169
add edx, 0x1a14019e
sub edx, 0x1a14019a
loop 0x406da4
add eax, 0x816a3078
sub eax, 0x8168ff29
mov ebx, eax
add eax, 5
mov ecx, 0x296d8961
add ecx, 0xd6d2769f
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x40d442
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403050]
jne 0x40dfdd
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x410948], eax
mov dword [0x410944], ecx
mov dword [0x410940], edx
mov dword [0x41093c], ebx
mov dword [0x410938], esi
mov dword [0x410934], edi
mov word [0x410960], ss
mov word [0x410954], cs
mov word [0x410930], ds
mov word [0x41092c], es
mov word [0x410928], fs
mov word [0x410924], gs
pushfd
pop dword [0x410958]
mov eax, dword [ebp]
mov dword [0x41094c], eax
mov eax, dword [ebp + 4]
mov dword [0x410950], eax
lea eax, [ebp + 8]
mov dword [0x41095c], eax
mov eax, dword [ebp - 0x320]
mov dword [0x410898], 0x10001
mov eax, dword [0x410950]
mov dword [0x41084c], eax
mov dword [0x410840], 0xc0000409
mov dword [0x410844], 1
mov eax, dword [0x403050]
mov dword [ebp - 0x328], eax
mov eax, dword [0x410124]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x410890], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x403210
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x410890], 0
jne 0x40e0c9
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x30d32821
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x42f314
nop
mov ecx, 0x3a8b24ab
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x432084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x409820
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4683db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045ca3d
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4098a2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045a85d
mov eax, dword [eax]
push 0x47e1d0
push eax
call fcn.0044cd14
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045ccc8
test bl, bl
je 0x4098a2
push 0x47e1d0
lea ecx, [esp + 0xc]
call fcn.0045d058
push 0x481d44
lea ecx, [esp + 0xc]
call fcn.0045d058
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4098de
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045ccc8
jmp 0x4099a9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x409962
lea edx, [esp + 0x7c]
push 0x481d40
push edx
call fcn.0044cd14
add esp, 8
test eax, eax
je 0x409962
lea eax, [esp + 0x7c]
push 0x481d3c
push eax
call fcn.0044cd14
add esp, 8
test eax, eax
je 0x409962
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4098f2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045ccc8
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40a1a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40a202
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc