joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437a50
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x437a83
push esi
call fcn.0043ab40
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x437a7c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x437b09
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x437af2
mov eax, dword [esi + 8]
test eax, eax
je 0x437aa7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x437aee
cmp eax, 2
je 0x437af2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x437a9a
cmp eax, 3
je 0x437acd
cmp eax, 1
jne 0x437a9a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x437a9a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x437a9a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00437b30
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x437b18
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00437b30
add esp, 4
pop esi
ret

Function at 0x45604d
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x456085
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045411e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004540f6
jmp 0x456091
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x45773f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x457781
call fcn.0045d0c0
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x457781
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x457778
xor eax, eax
jmp 0x457789
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0045778f
pop edi
pop esi
pop ebx
ret 4

Function at 0x45d5f0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x45d61e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x45d63c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0045d556
jmp 0x45d63c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x45d63c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0045d556
test edi, edi
mov eax, edi
jne 0x45d626
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x50fd84
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, 0x5c833c
lea ecx, [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
xor ebx, ebx
xor esi, esi
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
test eax, eax
jle 0x50fe48
mov edx, dword [ecx]
movzx edx, byte [edx + ebx]
shr edx, 2
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 1]
shr ebp, 4
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 1], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 2]
shr ebp, 6
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 2], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 3], dl
add esi, 4
add ebx, 3
dec eax
jne 0x50fdbc
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
dec edx
je 0x50fe5f
dec edx
je 0x50fea0
jmp 0x50fefd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 2], 0x3d
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
jmp 0x50fefd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [ecx]
mov al, byte [eax + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 2], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x50ff60
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x50ff7d
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x51008f
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0x50ffb0
je 0x50fffc
sub ecx, 0x2b
je 0x50fff2
sub ecx, 4
je 0x50fff7
dec ecx
sub ecx, 0xa
jb 0x50ffe1
jmp 0x50ffff
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x50ffc2
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x50ffd0
jmp 0x50ffff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x50ffff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x50ffff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x50ffff
mov byte [eax], 0x3e
jmp 0x50ffff
mov byte [eax], 0x3f
jmp 0x50ffff
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x50ff8f
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0x51004f
cmp byte [esp + 3], 0xff
jne 0x51004f
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0x510087
cmp dl, 0xff
je 0x510087
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0x50ff88
add esp, 0xc
pop ebp
pop edi
pop esi
ret

Function at 0x51011c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x5d97a0
mov eax, ebx
mov edx, 8
test al, 1
je 0x510138
shr eax, 1
xor eax, 0xedb88320
jmp 0x51013a
shr eax, 1
dec edx
jne 0x51012b
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x510124
pop ebx
ret
Function at 0x510150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x510159
mov eax, dword [ebp - 4]
add esp, 0xfffffebc
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00507a38
xor eax, eax
push ebp
push 0x510239
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0051011c
mov eax, dword [0x5d8e0c]
mov byte [eax], 0
mov dword [ebx], reloc.RASAPI32.dll_RasHangUpA
mov edx, dword [ebp - 4]
lea eax, reloc.RASAPI32.dll_RasHangUpA
call fcn.00505e7c
mov edx, 1
lea eax, reloc.RASAPI32.dll_RasHangUpA
call fcn.00506218
call fcn.00505ba8
test eax, eax
jne 0x510216
lea eax, [ebp - 8]
push eax
lea edx, reloc.RASAPI32.dll_RasHangUpA
mov ecx, 0xfff1
lea eax, reloc.RASAPI32.dll_RasHangUpA
call fcn.00505fcc
mov dx, word [ebp - 8]
test dx, dx
jbe 0x510210
lea eax, reloc.RASAPI32.dll_RasHangUpA
xor ecx, ecx
mov cl, byte [eax]
mov esi, dword [ebx]
and esi, 0xff
xor ecx, esi
mov ecx, dword [ecx*4 + reloc.RASAPI32.dll_RasHangUpA]
mov esi, dword [ebx]
shr esi, 8
xor ecx, esi
mov dword [ebx], ecx
inc eax
dec dx
jne 0x5101ec
cmp dword [ebp - 8], 0
jne 0x5101c3
lea eax, reloc.RASAPI32.dll_RasHangUpA
call fcn.00505fec
not dword [ebx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x510240
lea eax, [ebp - 4]
call fcn.00507588
ret

Function at 0x51b718
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x51b738
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x51b726
pop edi
pop esi
pop ebx
ret
Function at 0x523fd4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor ebp, ebp
mov ebx, 0x5d9cb4
mov eax, ebp
shr eax, 1
and eax, 0xff
mov dword [esp], eax
mov esi, ebp
and esi, 1
mov eax, ebp
and eax, 0x200
shr eax, 8
or esi, eax
mov edx, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
mov eax, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
xor eax, dword [esp]
call fcn.00523f70
mov edi, eax
shl edi, 0x18
mov eax, edi
call fcn.00523fac
mov dword [ebx], eax
mov edx, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
mov eax, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
xor eax, dword [esp]
call fcn.00523f70
mov edi, eax
shl edi, 0x10
mov eax, edi
call fcn.00523fac
mov dword [ebx + reloc.RASAPI32.dll_RasHangUpA], eax
mov edx, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
mov eax, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
xor eax, dword [esp]
call fcn.00523f70
mov edi, eax
shl edi, 8
mov eax, edi
call fcn.00523fac
mov dword [ebx + reloc.RASAPI32.dll_RasHangUpA], eax
mov edx, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
mov eax, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
xor eax, dword [esp]
call fcn.00523f70
mov edi, eax
mov eax, edi
call fcn.00523fac
mov dword [ebx + reloc.RASAPI32.dll_RasHangUpA], eax
inc ebp
add ebx, 4
cmp ebp, 0x400
jne 0x523fe0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x524138
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
lea eax, [edx + eax*4 + 0x4c]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [eax + ebx*4], edx
inc ebx
cmp ebx, 3
jne 0x52416d
xor ebx, ebx
mov eax, ebx
mov esi, 3
xor edx, edx
div esi
mov eax, dword [ebp - 0x14]
lea eax, [eax + edx*4]
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [eax + ecx]
and edx, 3
mov esi, dword [ebp - 8]
lea edx, [esi + edx*2]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov dx, word [edx]
and dx, 1
movzx edx, dx
mov esi, dword [ebp - 0x18]
mov esi, dword [esi]
add esi, esi
or esi, edx
mov edi, dword [ebp - 0x18]
mov dword [edi], esi
mov esi, dword [ebp - 0x1c]
movzx esi, word [esi]
shr esi, 1
xor dx, 1
shl edx, 0xf
or si, dx
mov edx, dword [ebp - 0x1c]
mov word [edx], si
inc eax
cmp eax, 4
jne 0x524193
inc ebx
cmp ebx, 0xf
jne 0x52417d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jne 0x52414f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5ee479
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push dword [esp + 0x13]
mov byte [esp + 0x10], ah
jmp 0x5ee487
mov byte [esp + 0xf], dh
lea esp, [esp + 2]
mov dword [esp + 7], edi
lea edi, reloc.RASAPI32.dll_RasHangUpA
lea edi, [eax + ebx]
jmp 0x5ee4ba
lea edi, [esp - 0x4b]
lea edi, reloc.RASAPI32.dll_RasHangUpA
lea edi, [eax + eax]
not edi
jmp 0x5ee577
mov dl, byte [esp]
mov ebx, 0x4941fd5
pop ebx
mov dl, 0x8f
xchg dh, dl
setne dh
jmp 0x5ee537
push ebx
bswap edi
bswap dx
lea edx, [eax + ecx]
bswap ebx
mov di, si
jmp 0x5ee4dc
pop word [esp]
lea edi, [ebx + 0xb7]
mov byte [esp], bh
mov edi, dword [esp]
lea edi, reloc.RASAPI32.dll_RasHangUpA
lea esp, [esp + 2]
jmp 0x5ee4fe
setp dh
lea edi, [eax*4]
mov edx, dword [esp + 1]
mov di, 0x989
lea edi, [esi + esi]
lea edi, [ecx + edi]
jmp 0x61b7a8
mov di, word [esp]
push esi
xchg word [esp], di
mov dword [esp], ebx
bswap dx
mov edx, 0x1c5a683e
jmp 0x5ee517
mov di, 0x58f9
mov dword [esp + 1], edx
mov dh, dl
mov dh, 0x2e
mov dl, al
jmp 0x5ee558
mov edi, dword [esp + 7]
lea esp, [esp + 0x28]
lea esp, [esp + 4]
jmp 0x61b78f
push cx
lea esp, [esp + 2]
jmp 0x61b83b
lea edi, [eax + eax]
mov di, word [esp]
lea edi, [eax + ebp]
mov di, 0x96c
mov edi, 0x4ac3bc2
bswap edi
jmp 0x61b77d
movzx eax, word [ebp + 8]
xchg cl, ch
jmp 0x61ba78
mov ebp, esp
bswap dx
clc
add ch, cl
mov ch, 0xcb
jmp 0x61b807
pushfd
push cx
lea esp, [esp + 2]
lea esp, [esp + 4]
push ebp
jmp 0x61b81d
push ebx
mov ebx, dword [ebp + 0xc]
and edx, esp
jmp 0x61bd23
movzx ecx, word [ebp + 0xc]
bts dx, dx
mov edx, 0x78e24f5b
mov dh, dl
jmp 0x61ba59
lea esp, [esp + 0xc]
movzx esi, si
jmp 0x61bced
shr ebx, 0x10
clc
neg dx
neg dx
sub esp, 0xe
lea esp, [esp + 2]
jmp 0x61bc99
lea edx, [esi - 0xe1]
not edx
mov edx, dword [esp]
shr esi, 0x10
jmp 0x61bcaf
mov word [esp + 1], cx
cmc
lea esp, [esp + 2]
jmp 0x61bcfc
mov edx, eax
movzx ebx, bx
sub esp, 0x10
pop word [esp + 4]
jmp 0x61bcd7
lea esp, [esp + 0xc]
imul edx, ecx
push esp
push word [esp + 3]
clc
jmp 0x61bdc9
xlatb
popal
in al, dx
jnp 0x61bd03
invalid
push esi
setae dh
mov dx, word [esp]
add si, bx
mov esi, dword [ebp + 8]
jmp 0x61bcc7
pushal
xchg al, ah
mov dword [esp + 4], ebx
sub esp, 0x11
push dword [esp + 0xd]
lea esp, [esp + 0x13]
jmp 0x61bd60
imul eax, ebx
mov esi, 0x17564cca
bt esi, eax
lea esi, [ecx + edi]
rcl esi, 0x12
jmp 0x61bd33
push word [esp + 1]
lea esp, [esp + 4]
popal
jmp 0x61bd9d
lea esp, [esp + 4]
imul ecx, esi
mov dword [ebp + 0xc], esi
jmp 0x61bd4c
add eax, ecx
call fcn.0061bdb2
loopne 0x61bd13
adc esi, dword [esi - 0x7b]
xor dword [esi + ebp - reloc.RASAPI32.dll_RasHangUpA], ecx
dec edi
push cx
imul esi, dword [ebp + 0xc]
sub esp, 0x17
mov dword [esp + 0x10], edi
lea esp, [esp + 0xc]
lea esp, [esp + 3]
jmp 0x61bd87
lea esp, [esp + 2]
jmp 0x61bd7b
Function at 0x71db8a
Capabilities:
Parse pe header

Disassembly:
call fcn.0071c575
jmp 0x71dccb
mov dword [esp + 0x50], esi
call fcn.0071dc97
mov word [esp], cx
mov word [esp + 4], bx
mov byte [esp + 5], ch
mov byte [esp + 5], ah
mov byte [esp + 1], dh
jmp 0x71dc6b
push dword [esp + 7]
push word [esp + 4]
lea esp, [esp + 3]
pushfd
push word [esp + 0xb]
lea esp, [esp + 3]
jmp 0x71dc28
lea esp, [esp + 1]
mov byte [esp + 1], al
lea esp, [esp]
mov word [esp + 3], bx
pushal
lea esp, [esp + 3]
jmp 0x71dcb4
mov eax, dword fs:[0x30]
jmp 0x71dce5
mov dword [esp + 0x70], edi
lea esp, [esp + 0x70]
jmp 0x71dc9c
lea esp, [esp + 6]
pushfd
push dword [esp]
mov dword [esp + 1], eax
pop word [esp + 1]
mov dword [esp + 3], ebp
jmp 0x71dc52
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x71dcf3
mov eax, dword [eax + 8]
push eax
jmp 0x71c570

Function at 0x71dc31
Capabilities:
Parse pe header

Disassembly:
call fcn.0071c575
jmp 0x71dccb
mov dword [esp + 0x50], esi
call fcn.0071dc97
mov word [esp], cx
mov word [esp + 4], bx
mov byte [esp + 5], ch
mov byte [esp + 5], ah
mov byte [esp + 1], dh
jmp 0x71dc6b
push dword [esp + 7]
push word [esp + 4]
lea esp, [esp + 3]
pushfd
push word [esp + 0xb]
lea esp, [esp + 3]
jmp 0x71dc28
lea esp, [esp + 1]
mov byte [esp + 1], al
lea esp, [esp]
mov word [esp + 3], bx
pushal
lea esp, [esp + 3]
jmp 0x71dcb4
mov eax, dword fs:[0x30]
jmp 0x71dce5
mov dword [esp + 0x70], edi
lea esp, [esp + 0x70]
jmp 0x71dc9c
lea esp, [esp + 6]
pushfd
push dword [esp]
mov dword [esp + 1], eax
pop word [esp + 1]
mov dword [esp + 3], ebp
jmp 0x71dc52
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x71dcf3
mov eax, dword [eax + 8]
push eax
jmp 0x71c570
Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0x4036c3
Capabilities:
Parse pe header

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
lea eax, [edi + 1]
shr eax, 1
push eax
push esi
push 0
call fcn.00403750
add esp, 0xc
cmp word [esi], 0x5a4d
movzx ecx, ax
jne 0x403749
mov eax, dword [esi + 0x3c]
add eax, esi
cmp dword [eax], 0x4550
jne 0x403749
mov dx, word [eax + 0x18]
cmp dx, 0x10b
je 0x403707
cmp dx, 0x20b
jne 0x403749
mov edx, dword [eax + 0x58]
mov esi, 0xffff
cmp cx, dx
jb 0x40371d
push ebx
movzx ebx, dx
sub ecx, ebx
pop ebx
jmp 0x403722
sub ecx, edx
and ecx, esi
dec ecx
shr edx, 0x10
cmp cx, dx
jb 0x403731
movzx edx, dx
sub ecx, edx
jmp 0x403736
sub ecx, edx
and ecx, esi
dec ecx
mov edx, dword [esp + 0x18]
add ecx, edi
mov dword [edx], ecx
mov edx, dword [esp + 0x14]
mov ecx, dword [eax + 0x58]
mov dword [edx], ecx
jmp 0x40374b
xor eax, eax
pop edi
pop esi
ret 0x10
Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..data
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6f67312a
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data_1
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x2d3d4832
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x548074e2
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5f1b0834
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219