joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bb1c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x42bb2b
pop dword [ebp - 0x18]
mov eax, 0x4ba3c8c0
add eax, 0xb49ef26b
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x51f6e
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x4f71
xor edi, edi
add edi, eax
mov esi, 0xb9990198
add esi, 0x46ae5c68
add esi, dword [ebp - 0x18]
mov ebx, 0x89e8f4a4
add ebx, 0x58b89f5b
sub dword [ebp - 0x10], ecx
mov edx, dword [esi]
xor dword [ebp - 0x14], 0xe89b5542
add edx, ebx
sub dword [ebp - 4], esi
mov dword [edi], edx
mov dword [ebp - 0x10], 0xdaec5070
add edi, 4
add esi, 4
loop 0x42bb81
add eax, 0x13097
mov ebx, eax
add eax, 0xa18786b8
sub eax, 0xa18786b3
mov ecx, 0x68832d6a
add ecx, 0x97bcd296
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x100044b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.100040d0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100044e2
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x10031140]
call dword [ebp - 8]
jmp 0x100044ec
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x1001a790
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.100067d0
lea ecx, [ebp - 4]
call fcn.1001a760
movzx eax, al
test eax, eax
jne 0x1001a7cd
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 4]
call fcn.1001a6a0
mov eax, dword [ebp - 0x18]
jmp 0x1001a8f5
lea ecx, [ebp - 4]
call fcn.10006b70
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.1001a720
add esp, 4
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x10]
sar edx, 1
mov dword [ebp - 0x14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
call fcn.10006b70
push eax
push 0
push 0
call fcn.1001a5e0
add esp, 0x20
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1001a833
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 4]
call fcn.1001a6a0
mov eax, dword [ebp - 0x20]
jmp 0x1001a8f5
push 0x66
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1000a8c0
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.100028c0
lea ecx, [ebp - 8]
call fcn.10002900
movzx edx, al
test edx, edx
jne 0x1001a87c
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 8]
call fcn.100028e0
lea ecx, [ebp - 4]
call fcn.1001a6a0
mov eax, dword [ebp - 0x24]
jmp 0x1001a8f5
lea ecx, [ebp - 8]
call fcn.10002940
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 4]
call fcn.10006b70
mov dword [ebp - 0x2c], eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
call fcn.1001a5e0
add esp, 0x20
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x1001a8d7
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 8]
call fcn.100028e0
lea ecx, [ebp - 4]
call fcn.1001a6a0
mov eax, dword [ebp - 0x34]
jmp 0x1001a8f5
lea ecx, [ebp - 8]
call fcn.100074e0
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 8]
call fcn.100028e0
lea ecx, [ebp - 4]
call fcn.1001a6a0
mov eax, dword [ebp - 0x38]
mov esp, ebp
pop ebp
ret

Function at 0x1001afc0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1001a980
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001aff4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x10031140]
call dword [ebp - 8]
jmp 0x1001affa
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1001b050
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1001a9c0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001b084
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x10031140]
call dword [ebp - 8]
jmp 0x1001b08e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001b0a0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1001a9e0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001b0d8
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x10031140]
call dword [ebp - 8]
jmp 0x1001b0e6
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8
Function at 0x10029b30
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.10030600
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x10041138]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x10029d08
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x10029c57
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x10029c57
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x10029c35
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x10029bb9
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10029cc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x10029d28
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x10029d03
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x10029d28
jmp 0x10029b92
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001230
mov esp, ebp
pop ebp
ret
Function at 0x10029d40
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.10030600
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x10041138]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x10029f2b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x10029e76
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x10029e76
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x10029e52
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x10029dc9
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10029ee4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x10029f4b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x10029f26
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x10029f4b
jmp 0x10029da2
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001230
mov esp, ebp
pop ebp
ret
Function at 0x40644e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x40645d
pop dword [ebp - 0x38]
mov eax, 0x864e9fd0
add eax, 0x79f1c48d
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x5a96038d
add dword [ebp - 0x48], 0xf3bc41be
mov dword [ebp - 0x44], 0x6507521e
sub dword [ebp - 0x44], 0x32d405d9
mov dword [ebp - 0x40], 0x203af1df
add dword [ebp - 0x40], 0x2c11524f
mov dword [ebp - 0x3c], 0xaabd36fc
sub dword [ebp - 0x3c], 0xaabd36fc
lea eax, [ebp - 0x48]
push eax
mov eax, 0x5774c85f
add eax, 0xa8cbb819
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x3b3b5622
add dword [ebp - 0x48], 0x39371334
mov dword [ebp - 0x44], 0x343345f1
sub dword [ebp - 0x44], 0xf2c6e47c
mov dword [ebp - 0x40], 0x2fb9cd59
add dword [ebp - 0x40], 0x33b59f13
mov dword [ebp - 0x3c], 0xa7b2d834
sub dword [ebp - 0x3c], 0xa7b2d834
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x1421b4f
sub eax, 0x1019ad3
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3a1b7
push 0
call eax
mov ecx, 0x4038dd98
add ecx, 0xbfc776a0
mov edi, eax
mov ebx, 0xb9d7a5f9
sub ebx, 0xb99291f9
add ebx, dword [ebp - 0x38]
mov esi, 0x501bb4de
sub dword [ebp - 0x20], edi
mov edx, dword [ebx]
xor edx, esi
mov dword [edi], edx
add edi, 0xa2afeef2
sub edi, 0xa2afeeee
add ebx, 4
loop 0x406579
add eax, 0x18a4f8a1
sub eax, 0x18a3b4ee
mov ebx, eax
add eax, 0xd9463317
add eax, 0x26b9ccee
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40bdb9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40bdc8
pop dword [ebp - 0x4c]
mov eax, 0x40bdc8
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x9fc1506d
sub dword [ebp - 0x5c], 0x516f0b22
mov dword [ebp - 0x58], 0x520321f0
add dword [ebp - 0x58], 0xe0302a55
mov dword [ebp - 0x54], 0xc7016960
sub dword [ebp - 0x54], 0x7ab52532
mov dword [ebp - 0x50], 0x9a947352
sub dword [ebp - 0x50], 0x9a947352
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xe91f976a
sub eax, 0xe8dec716
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xfe3addda
sub dword [ebp - 0x5c], 0x89c87484
mov dword [ebp - 0x58], 0xfcf1a307
add dword [ebp - 0x58], 0x447abe6e
mov dword [ebp - 0x54], 0xcdcaf506
sub dword [ebp - 0x54], 0x6a5b889a
mov dword [ebp - 0x50], 0x4c94532d
sub dword [ebp - 0x50], 0x4c94532d
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xf071b8bd
sub eax, 0xf030e871
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a4b2
push 0
call eax
mov ecx, 0x4b18
mov edx, eax
mov ebx, 0x3ab471df
sub ebx, 0x3a72c1df
add ebx, dword [ebp - 0x4c]
mov edi, 0xfe230bfc
add edi, 0xf5846cd5
add dword [ebp - 0x10], edx
mov esi, dword [ebx]
sub dword [ebp - 0x10], 0x387fb968
sub esi, edi
xor dword [ebp - 0x28], 0x12fe46d8
mov dword [edx], esi
add dword [ebp - 0x40], 0xaa20fce5
add edx, 0x38b7e62f
sub edx, 0x38b7e62b
add ebx, 0xb3effe75
sub ebx, 0xb3effe71
loop 0x40bedf
add eax, 0xa35c7d7e
add eax, 0x5ca4a1b5
xor ebx, ebx
add ebx, eax
add eax, 0xd4cd478c
sub eax, 0xd4cd4787
mov ecx, 0x9b6066bb

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x372a16a8
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x49752f14
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x40ce09
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422234]
jne 0x40ce13
repz ret
jmp fcn.00413639

Function at 0x413b7e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004104e0
and dword [ebp - 4], 0
cmp dword [0x423e1c], 0
mov ebx, eax
jne 0x413c2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413ce0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413ce0
push eax
call fcn.0041046e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423e1c], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423e20], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x423e24], eax
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e2c], eax
test eax, eax
je 0x413c2f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e28], eax
mov eax, dword [0x423e28]
cmp eax, ebx
je 0x413c87
cmp dword [0x423e2c], ebx
je 0x413c87
push eax
call fcn.004104e9
push dword [0x423e2c]
mov esi, eax
call fcn.004104e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413c87
test edi, edi
je 0x413c87
call esi
test eax, eax
je 0x413c7e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413c7e
test byte [ebp - 0xc], 1
jne 0x413c87
or dword [ebp + 0x10], 0x200000
jmp 0x413cc0
mov eax, dword [0x423e20]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413cc0
mov eax, dword [0x423e24]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423e1c]
call fcn.004104e9
pop ecx
test eax, eax
je 0x413ce0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413ce2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x100015e0
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10001600
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
mov edi, ecx
jne 0x10001616
push 0x80004005
call fcn.100011d0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0xc]
mov edx, dword [edi]
add eax, 1
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 0xc

Function at 0x10001640
Capabilities:
Set registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
mov dword [esp + 4], ecx
jne 0x10001658
push 0x80004005
call fcn.100011d0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
add eax, 1
add esi, eax
add edi, eax
cmp eax, 1
jne 0x10001665
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret 8
Function at 0x10002000
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x10040020]
xor eax, esp
mov dword [esp + 0x118], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x12c]
mov ebp, ecx
mov eax, dword [ebp]
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push 0
push edi
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0xc]
mov esi, eax
test esi, esi
jne 0x1000206e
test ecx, ecx
je 0x10002060
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [esp + 0x14]
mov esi, eax
mov dword [esp + 0xc], ecx
je 0x1000207c
test ecx, ecx
je 0x10002121
push ecx
jmp 0x1000211b
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x38]
push edx
push 0
push ecx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
jne 0x100020ee
jmp 0x100020b0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x10]
call fcn.10002000
mov edi, eax
test edi, edi
jne 0x1000213d
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x10]
push eax
push eax
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x38]
push eax
push edi
push ecx
mov dword [esp + 0x30], 0x100
call esi
test eax, eax
je 0x100020b0
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10002105
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
mov edx, dword [ebp]
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10002121
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1001dd14
add esp, 0x11c
ret 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1000214c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x10002123