joyce8/EMBER2024-capa huggingface dataset:
Function at 0x324353ac
Capabilities:
Encode data using xor
Set registry value

Disassembly:
push ebp
push esp
pop ebp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0x18], ebx
push esi
push edi
mov byte [ebp - 1], bl
jne 0x324353e3
push 0x24
pop eax
call fcn.32438510
push esp
pop edx
mov dword [ebp + 0x18], edx
mov esi, dword [0x32439a90]
push dword [ebp + 0x18]
pop edi
push 0x21
pop ecx
lodsb al, byte [esi]
add al, 0xa1
xor al, 0x72
stosb byte es:[edi], al
dec ecx
jne 0x324353d7
mov dword [ebp + 0x18], edx
push dword [ebp + 0x1c]
pop edi
cmp edi, ebx
mov esi, edi
jne 0x324353f2
mov esi, 0x80000001
cmp edi, ebx
push edi
pop eax
jne 0x324353fe
push 0x80000002
pop eax
cmp esi, eax
ja 0x32435448
lea eax, [ebp + 0x1c]
push ebx
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push dword [ebp + 0x18]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x32435445
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x3243543c
mov byte [ebp - 1], 1
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
jmp 0x324353f2
mov al, byte [ebp - 1]
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x32435458
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push esp
pop ebp
push 0xffffffffffffffff
push dword [0x32439930]
push dword [0x3243992c]
push dword fs:[0]
pop eax
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 0x1c], 0
and dword [ebp - 4], 0
cmp dword [ebp + 0x10], 8
jae 0x324355a3
push dword [ebp + 8]
pop ecx
mov dword [ebp - 0x2c], ecx
cmp word [ecx], 0x5a4d
jne 0x324355a3
push dword [ecx + 0x3c]
pop eax
add eax, ecx
mov dword [ebp - 0x38], eax
cmp dword [eax], 0x4550
jne 0x324355a3
mov esi, dword [eax + 0x78]
add esi, ecx
mov dword [ebp - 0x20], esi
push dword [eax + 0x7c]
pop eax
add eax, esi
mov dword [ebp - 0x28], eax
cmp esi, ecx
je 0x324355a3
push dword [esi + 0x1c]
pop ebx
add ebx, ecx
mov dword [ebp - 0x34], ebx
mov eax, dword [esi + 0x24]
add eax, ecx
mov dword [ebp - 0x24], eax
push dword [esi + 0x20]
pop edi
add edi, ecx
mov dword [ebp - 0x3c], edi
xor eax, eax
mov dword [ebp - 0x30], eax
cmp eax, dword [esi + 0x18]
jae 0x324355a3
push dword [edi + eax*4]
pop eax
add eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_lstrcmpA]
test eax, eax
jne 0x32435590
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
movzx eax, word [eax + ecx*2]
mov ebx, dword [ebx + eax*4]
add ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
cmp ebx, esi
jb 0x324355a3
mov eax, dword [ebp - 0x28]
cmp ebx, eax
ja 0x324355a3
push 0x2e
push ebx
call fcn.32438418
pop ecx
pop ecx
push eax
pop ebx
mov dword [ebp - 0x40], ebx
test ebx, ebx
je 0x3243558a
mov esi, ebx
sub esi, dword [ebp - 0x1c]
mov dword [ebp - 0x48], esi
lea eax, [esi + 1]
add eax, 3
and al, 0xfc
call fcn.32438510
mov dword [ebp - 0x18], esp
push esp
pop edi
mov dword [ebp - 0x44], edi
push esi
push dword [ebp - 0x1c]
push edi
call fcn.324383eb
add esp, 0xc
and byte [esi + edi], 0
inc dword [ebp + 0x10]
push dword [ebp + 0x10]
inc ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call fcn.32435458
mov dword [ebp - 0x1c], eax
jmp 0x324355a3
and dword [ebp - 0x1c], 0
jmp 0x324355a3
inc dword [ebp - 0x30]
push dword [ebp - 0x30]
pop eax
jmp 0x324354f3
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0
jne 0x324355bc
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
pop eax
lea esp, [ebp - 0x54]
push dword [ebp - 0x10]
pop ecx
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x32435eec
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
xor eax, eax
push eax
push eax
push dword [str.lIC2]
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
Function at 0x3243612c
Capabilities:
Encode data using xor
Read file via mapping

Disassembly:
push ebp
push esp
pop ebp
push 0xffffffffffffffff
push dword [0x32439d64]
push dword [0x3243992c]
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 5
mov dword [ebp - 4], ebx
mov eax, dword [0x3243ab70]
cmp eax, ebx
jne 0x32436239
cmp byte [0x3243a67c], bl
je 0x324361a3
push 0x1c
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x28], esp
mov esi, 0x32439e10
mov edi, dword [ebp - 0x28]
mov ecx, 0x19
lodsb al, byte [esi]
sub al, 0x24
add al, 0x93
stosb byte es:[edi], al
dec ecx
jne 0x32436196
mov eax, esp
jmp 0x324361c8
push 0x14
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x30], esp
mov esi, dword [0x32439c0c]
mov edi, dword [ebp - 0x30]
push 0x12
pop ecx
lodsb al, byte [esi]
xor al, 0xe1
sub al, 0x8c
stosb byte es:[edi], al
dec ecx
jne 0x324361bd
push esp
pop eax
push eax
push 4
push ebx
push 4
call fcn.32434924
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_CreateFileMappingA]
mov dword [0x3243ab6c], eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 0x24], eax
push dword [0x3243ab6c]
pop eax
cmp eax, ebx
je 0x3243622e
push 4
push ebx
push ebx
push 6
push eax
call dword [sym.imp.KERNEL32.DLL_MapViewOfFile]
mov dword [0x3243ab70], eax
cmp eax, ebx
je 0x3243621c
cmp dword [ebp - 0x24], 0xb7
je 0x32436239
mov dword [eax], 5
jmp 0x32436233
push dword [0x3243ab6c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [0x3243ab70]
or dword [ebp - 4], 0xffffffff
jmp 0x32436250
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
jmp 0x32436233
push dword [ebp - 0x1c]
pop ecx
push 5
pop edx
cmp ecx, edx
jne 0x3243626f
cmp dword [ebp - 0x24], 0xb7
jne 0x3243626d
mov dword [ebp - 0x20], 1
jmp 0x32436298
cmp ecx, edx
jbe 0x3243627a
mov dword [ebp - 0x20], 2
jmp 0x32436298
jae 0x32436298
mov dword [0x324395c4], ecx
mov dword [ebp - 4], 1
mov dword [eax], edx
jmp 0x32436294
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0x44]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x324362b0
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
push esp
pop ebp
mov al, byte [ebp + 0x18]
push ebx
xor ebx, ebx
push esi
neg al
sbb eax, eax
push ebx
and eax, 2
or al, 0x20
push eax
push 2
push ebx
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
push eax
pop esi
cmp esi, 0xffffffff
je 0x32436338
cmp byte [ebp + 0x14], bl
je 0x324362f8
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push dword [ebp + 8]
push ebx
call fcn.32434058
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp + 0x18]
push ebx
push eax
push edi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
and eax, eax
je 0x32436317
cmp edi, dword [ebp + 0x18]
jne 0x32436317
mov bl, 1
push dword [0x324394d8]
push dword [0x32439a58]
push dword [0x32439520]
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, bl
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x32436340
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x28
cmp dword [0x3243ab74], 0
push ebx
push esi
push edi
jne 0x3243649a
and byte [ebp - 1], 0
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
call fcn.3243461c
mov ebx, eax
test ebx, ebx
je 0x3243647d
push 0x14
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
mov esi, dword [0x32439ae0]
push dword [ebp - 0x18]
pop edi
mov ecx, 0x11
lodsb al, byte [esi]
sub al, 0xaf
xor al, 0x25
stosb byte es:[edi], al
dec ecx
jne 0x3243638b
push 0
push dword [ebp - 0x18]
push ebx
call fcn.32435458
push eax
pop esi
and esi, esi
je 0x3243647d
mov ebx, 0x98
push ebx
call fcn.32438354
and dword [ebp - 8], 0
push eax
pop edi
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], ebx
push edi
mov dword [ebp - 0x14], edi
mov dword [edi], ebx
call esi
cmp eax, 0x25b
jne 0x324363f5
push edi
call fcn.32438368
push dword [ebp - 0xc]
call fcn.32438354
pop ecx
mov dword [ebp - 0x14], eax
pop ecx
mov dword [eax], ebx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
call esi
test eax, eax
jne 0x3243646e
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov esi, dword [0x32439dd4]
mov edi, dword [ebp - 0x18]
push 8
pop ecx
lodsb al, byte [esi]
xor al, 0x4e
sub al, 0x1f
stosb byte es:[edi], al
dec ecx
jne 0x3243640b
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push 0x32439b90
pop esi
mov edi, dword [ebp - 0x18]
push 7
pop ecx
lodsb al, byte [esi]
sub al, 0x35
xor al, 0xa9
stosb byte es:[edi], al
dec ecx
jne 0x32436426
and dword [ebp - 0x18], 0
cmp dword [ebp - 8], 0
jbe 0x3243646e
mov eax, dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
lea edi, [eax + 4]
lea eax, [ebp - 0x28]
push eax
push edi
call esi
test eax, eax
je 0x3243646a
lea eax, [ebp - 0x20]
push eax
push edi
call esi
test eax, eax
je 0x3243646a
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
add edi, ebx
cmp eax, dword [ebp - 8]
jb 0x32436445
jmp 0x3243646e
mov byte [ebp - 1], 1
cmp dword [ebp - 0x14], 0
je 0x3243647d
push dword [ebp - 0x14]
call fcn.32438368
pop ecx
cmp dword [ebp - 0x10], 0
je 0x3243648c
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor eax, eax
cmp byte [ebp - 1], al
sete al
inc eax
mov dword [0x3243ab74], eax
cmp dword [0x3243ab74], 1
lea esp, [ebp - 0x34]
pop edi
pop esi
sete al
pop ebx
leave
ret
Function at 0x324367e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push dword [0x32439c00]
push dword [0x3243992c]
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x164
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
sub ebx, ebx
cmp dword [ebp + 0xc], ebx
jne 0x32436822
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], ebx
push 0x1c
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
push esp
pop edx
mov dword [ebp - 0x158], edx
mov esi, 0x324398fc
mov edi, dword [ebp - 0x158]
push 0x19
pop ecx
lodsb al, byte [esi]
xor al, 0x80
add al, 0x9d
stosb byte es:[edi], al
dec ecx
jne 0x32436846
mov dword [ebp - 0x15c], edx
push ebx
push edx
push dword [0x3243a9b8]
call fcn.32435458
mov dword [ebp - 0x24], eax
push 0x10
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
push esp
pop edx
mov dword [ebp - 0x160], edx
mov esi, dword [str.YlhfXX]
push dword [ebp - 0x160]
pop edi
push 0xf
pop ecx
lodsb al, byte [esi]
sub al, 0x14
xor al, 0x37
stosb byte es:[edi], al
dec ecx
jne 0x32436888
mov dword [ebp - 0x164], edx
push ebx
push edx
push dword [0x3243a9b8]
call fcn.32435458
mov dword [ebp - 0x20], eax
push 0x10
pop eax
call fcn.32438510
mov dword [ebp - 0x18], esp
mov edx, esp
mov dword [ebp - 0x168], edx
mov esi, dword [str.Qornn._Sim_]
push dword [ebp - 0x168]
pop edi
push 0xe
pop ecx
lodsb al, byte [esi]
add al, 0xfe
xor al, 0x1f
stosb byte es:[edi], al
dec ecx
jne 0x324368ca
mov dword [ebp - 0x16c], edx
push ebx
push edx
push dword [0x3243a9b8]
call fcn.32435458
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], ebx
je 0x3243699f
cmp dword [ebp - 0x20], ebx
je 0x3243699f
cmp eax, ebx
je 0x3243699f
push ebx
push 2
call dword [ebp - 0x24]
push eax
pop esi
mov dword [ebp - 0x28], esi
cmp esi, 0xffffffff
je 0x3243699f
mov dword [ebp - 0x150], 0x128
push 0x49
pop ecx
sub eax, eax
lea edi, [ebp - 0x14c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x150]
push eax
push esi
call dword [ebp - 0x20]
test eax, eax
je 0x3243698f
push 0x5c
lea eax, [ebp - 0x12c]
push eax
call fcn.32438270
pop ecx
pop ecx
mov dword [ebp - 0x154], eax
cmp eax, ebx
jne 0x32436963
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x154], eax
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.324384c8
add esp, 0xc
test eax, eax
jne 0x32436982
push dword [ebp - 0x148]
call fcn.324369bc
pop ecx
lea eax, [ebp - 0x150]
push eax
push esi
call dword [ebp - 0x1c]
jmp 0x32436939
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea esp, [ebp - 0x180]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x324369bc
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
xor ebx, ebx
push ebx
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
push eax
pop esi
cmp esi, ebx
je 0x324369e8
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
test eax, eax
je 0x324369e1
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, bl
pop esi
pop ebx
ret
Function at 0x324369f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0xc
push ebx
push esi
push edi
push 8
pop eax
sub ebx, ebx
call fcn.32438510
mov dword [ebp - 4], esp
mov esi, dword [0x32439bd0]
push dword [ebp - 4]
pop edi
mov ecx, 8
lodsb al, byte [esi]
xor al, 0x8c
add al, 0x61
stosb byte es:[edi], al
dec ecx
jne 0x32436a15
push esp
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push 0x10
mov dword [ebp - 8], eax
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
push 0x32439acc
pop esi
push dword [ebp - 4]
pop edi
push 0xe
pop ecx
lodsb al, byte [esi]
sub al, 0x8a
add al, 0x58
stosb byte es:[edi], al
dec ecx
jne 0x32436a40
push ebx
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.32435458
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x32436a91
push 8
pop eax
call fcn.32438510
mov dword [ebp - 4], esp
push dword [0x32439ca8]
pop esi
mov edi, dword [ebp - 4]
push 5
pop ecx
lodsb al, byte [esi]
add al, 0xaf
xor al, 0x1e
stosb byte es:[edi], al
dec ecx
jne 0x32436a74
push 5
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
push ebx
call dword [ebp - 0xc]
cmp eax, 0x20
seta bl
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea esp, [ebp - 0x18]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x32436bf8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0x7fff
pop ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
ja 0x32436c0d
push dword [ebp + 0xc]
pop ebx
lea esi, [ebx + 1]
push esi
call fcn.32438354
cmp dword [ebp + 8], 0
push eax
pop edi
pop ecx
mov dword [ebp + 0xc], edi
je 0x32436c35
push ebx
push dword [ebp + 8]
push edi
call fcn.324383eb
add esp, 0xc
and byte [ebx + edi], 0
jmp 0x32436c41
push esi
push 0
push edi
call fcn.324383b2
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x32436c8c
push 8
pop eax
call fcn.32438510
mov dword [ebp + 8], esp
push 0x32439ed0
pop esi
push dword [ebp + 8]
pop edi
push 7
pop ecx
lodsb al, byte [esi]
xor al, 0xc5
sub al, 0x64
stosb byte es:[edi], al
dec ecx
jne 0x32436c5f
xor esi, esi
push esi
push esi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.3243456c
mov ebx, eax
cmp ebx, esi
jne 0x32436c8c
push dword [ebp + 0xc]
call fcn.32438368
pop ecx
mov dword [ebp + 0xc], esi
jmp 0x32436ca0
push ebx
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 8
push dword [0x3243a384]
call fcn.32437d00
push dword [ebp + 0xc]
pop eax
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x324370cc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push dword [0x3243a46c]
push dword [0x32439ef0]
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], ebx
push dword [0x3243ab94]
pop eax
cmp dword [eax + 0x184], ebx
je 0x32437207
push dword [0x3243ab94]
pop eax
cmp dword [eax + 0x180], ebx
je 0x32437207
mov eax, dword [0x3243ab94]
mov esi, dword [eax + 0x184]
mov dword [ebp - 0x28], esi
cmp dword [ebp + 0xc], ebx
je 0x32437167
mov dword [ebp - 0x1c], ebx
cmp esi, ebx
je 0x32437207
push dword [ebp + 0xc]
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
jne 0x3243715c
mov dword [ebp - 0x20], esi
jmp 0x32437207
push dword [esi]
pop esi
mov dword [ebp - 0x28], esi
inc dword [ebp - 0x1c]
jmp 0x3243713b
mov edi, dword [ebp + 8]
cmp edi, ebx
jne 0x324371a1
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [0x3243ab94]
sub edx, edx
div dword [ecx + 0x180]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1c], ebx
cmp esi, ebx
je 0x32437154
cmp dword [ebp - 0x1c], edx
je 0x32437154
mov eax, dword [esi]
cmp eax, ebx
je 0x32437154
mov esi, eax
mov dword [ebp - 0x28], esi
inc dword [ebp - 0x1c]
jmp 0x32437188
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], ebx
cmp esi, ebx
je 0x324371bd
cmp dword [esi + 4], edi
jne 0x324371b3
inc dword [ebp - 0x2c]
mov esi, dword [esi]
mov dword [ebp - 0x28], esi
inc dword [ebp - 0x1c]
jmp 0x324371a7
cmp dword [ebp - 0x2c], ebx
je 0x32437207
mov eax, dword [0x3243ab94]
mov esi, dword [eax + 0x184]
mov dword [ebp - 0x28], esi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub edx, edx
div dword [ebp - 0x2c]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1c], ebx
cmp esi, ebx
je 0x32437207
cmp dword [esi + 4], edi
jne 0x324371f6
cmp dword [ebp - 0x24], ebx
je 0x32437154
dec dword [ebp - 0x24]
mov esi, dword [esi]
mov dword [ebp - 0x28], esi
inc dword [ebp - 0x1c]
jmp 0x324371e1
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
push dword [ebp - 0x10]
pop ecx
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x32437d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x104
push ebx
push esi
push edi
xor ebx, ebx
sub eax, eax
mov edi, 0x100
mov byte [eax + ebp - 0x104], al
inc eax
cmp eax, edi
jb 0x32437d15
mov byte [ebp - 1], bl
mov byte [ebp - 2], bl
xor esi, esi
push esi
pop eax
xor edx, edx
div dword [ebp + 0xc]
mov eax, dword [ebp + 8]
lea ecx, [esi + ebp - 0x104]
mov al, byte [eax + edx]
mov dl, byte [ecx]
add al, byte [ecx]
mov byte [ebp - 3], dl
add byte [ebp - 2], al
inc esi
movzx eax, byte [ebp - 2]
mov dl, byte [eax + ebp - 0x104]
cmp esi, edi
lea eax, [eax + ebp - 0x104]
mov byte [ecx], dl
mov cl, byte [ebp - 3]
mov byte [eax], cl
jb 0x32437d29
mov eax, dword [ebp + 0x18]
and eax, eax
jbe 0x32437dca
push dword [ebp + 0x10]
pop esi
mov edi, dword [ebp + 0x14]
sub edi, esi
mov dword [ebp + 8], eax
jmp 0x32437d7d
mov bl, byte [ebp + 0xf]
inc byte [ebp - 1]
movzx eax, byte [ebp - 1]
add bl, byte [eax + ebp - 0x104]
mov dl, byte [eax + ebp - 0x104]
lea eax, [eax + ebp - 0x104]
movzx ecx, bl
mov byte [ebp + 0xf], bl
mov bl, byte [ecx + ebp - 0x104]
lea ecx, [ecx + ebp - 0x104]
mov byte [eax], bl
mov byte [ecx], dl
mov cl, dl
add cl, byte [eax]
movzx eax, cl
mov al, byte [eax + ebp - 0x104]
xor al, byte [esi + edi]
mov byte [esi], al
inc esi
dec dword [ebp + 8]
jne 0x32437d7a
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x900
push ebx
push esi
push edi
push 0x27
call fcn.00401fb6
mov esi, dword [ebp + 8]
push dword [esi + 0xc]
mov edi, dword [0x413258]
push dword [esi]
push eax
lea eax, [ebp - 0x900]
push eax
call edi
and dword [ebp + 8], 0
add esp, 0x14
cmp dword [esi + 0x10], 0
jbe 0x401070
lea ebx, [esi + 0x14]
push dword [ebx]
lea eax, [ebp - 0x100]
push str._t0x_p_n
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x900]
push eax
call dword [sym.imp.7_lstrcatW]
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
add ebx, 4
cmp eax, dword [esi + 0x10]
jb 0x40103b
lea eax, [ebp - 0x900]
push eax
call fcn.00407690
pop ecx
call fcn.00403e13
push 0xa
call dword [sym.imp.7_ExitProcess]

Function at 0x4014ff
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
lea ecx, [esi + 8]
call fcn.00408761
push dword [ebp + 0xc]
lea edi, [esi + 0xc]
mov ecx, edi
call fcn.00401310
push 0x5c
mov ecx, edi
call fcn.00401410
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x401283
push edi
push edi
mov dword [0x417740], esi
mov dword [0x417748], edi
call dword [sym.imp.7_CreateThread]
cmp dword [0x417788], 2
mov dword [0x417744], eax
je 0x40155c
call fcn.00407853
push 0xffffffffffffffff
push dword [0x417744]
call dword [sym.imp.7_WaitForSingleObject]
mov eax, dword [0x417748]
cmp eax, edi
mov dword [0x4177fc], edi
je 0x4015ab
cmp eax, 1
je 0x40159f
cmp eax, 2
je 0x40159b
cmp eax, 3
je 0x401597
cmp eax, 0x67
jle 0x401592
cmp eax, 0x6a
jle 0x40160f
push eax
push 0x14
jmp 0x4015e2
push 0x12
jmp 0x4015a1
push 0x13
jmp 0x4015a1
push 0x11
push edi
call fcn.0040775e
pop ecx
pop ecx
jmp 0x40160f
cmp dword [0x417804], edi
jne 0x40160f
lea eax, [ebp + 8]
push eax
push dword [0x417744]
call dword [sym.imp.7_GetExitCodeThread]
test eax, eax
mov ecx, dword [ebp + 8]
je 0x4015d2
cmp ecx, edi
jne 0x4015d2
xor eax, eax
jmp 0x401614
mov eax, 0x80070000
mov edx, ecx
and edx, eax
cmp edx, eax
je 0x4015e5
push ecx
push 0x21
push edi
jmp 0x401607
and ecx, 0xffff
cmp ecx, 0xe
jne 0x4015f9
cmp dword [0x41778c], 0xffffffff
je 0x40160f
push ecx
call dword [sym.imp.7_SetLastError]
push dword [ebp + 8]
push 0x22
push 1
call fcn.0040775e
add esp, 0xc
mov eax, 0x80004005
pop edi
pop esi
leave
ret 8

Function at 0x40197a
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
push 0
push dword [esp + 0xc]
call dword [sym.imp.7_CreateDirectoryW]
test eax, eax
jne 0x4019bb
call dword [sym.imp.7_GetLastError]
mov esi, 0xb7
cmp eax, esi
je 0x4019a5
push eax
call dword [sym.imp.7_SetLastError]
xor eax, eax
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.7_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4019bb
test al, 0x10
jne 0x4019bb
push esi
jmp 0x40199b
xor eax, eax
inc eax
pop esi
ret
Function at 0x401bf8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
push 0
call dword [sym.imp.7_GetModuleHandleW]
mov esi, dword [sym.imp.7_FindResourceExA]
mov ebx, eax
movzx eax, word [0x41774c]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call esi
mov edi, eax
test edi, edi
jne 0x401c3c
push 0x409
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call esi
mov edi, eax
test edi, edi
je 0x401c62
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x401c4d
push edi
push ebx
call dword [sym.imp.7_SizeofResource]
mov dword [esi], eax
push edi
push ebx
call dword [sym.imp.7_LoadResource]
test eax, eax
je 0x401c62
push eax
call dword [sym.imp.7_LockResource]
jmp 0x401cdc
cmp dword [0x41775c], 0
jne 0x401cda
mov esi, dword [sym.imp.7_LoadLibraryA]
push str.SetProcessPreferredUILanguages
mov ebx, str.kernel32
push ebx
mov dword [0x41775c], 1
call esi
mov edi, dword [sym.imp.7_GetProcAddress]
push eax
call edi
push 0
mov dword [ebp - 4], eax
movzx eax, word [0x41774c]
push 0x409
push 0
push eax
lea eax, [ebp - 0x44]
push str._04X_c_04X_c
push eax
call dword [0x413258]
add esp, 0x18
cmp dword [ebp - 4], 0
jne 0x401ccf
push str.SetThreadPreferredUILanguages
push ebx
call esi
push eax
call edi
test eax, eax
mov dword [ebp - 4], eax
je 0x401cda
push 0
lea eax, [ebp - 0x44]
push eax
push 4
call dword [ebp - 4]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret