joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c0fa
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3ec8], 1
jne 0x42c14c
or dword [0x4a3ec8], 1
mov dword [0x4a3600], 0xf7d6dac1
mov dword [0x4a3604], 0xf7e6f7fe
mov dword [0x4a3608], 0xbaebf7d9
mov dword [0x4a360c], 0xf3f4b2bb
mov dword [0x4a3610], 0xf6f7fefb
mov word [0x4a3614], 0xb2a8
mov byte [0x4a3616], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a3600]
xor cl, 0x92
mov byte [eax + 0x4a3d8c], cl
inc eax
cmp eax, 0x17
jb 0x42c14e
mov eax, 0x4a3d8c
ret

Function at 0x42c169
Capabilities:
Delete registry value

Disassembly:
push 0x88
mov eax, 0x470e2a
call fcn.00455d47
push 7
pop eax
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], esi
mov word [ebp - 0x48], cx
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0042a80d
push dword [ebp + 8]
call fcn.0042a324
mov ecx, dword [ebp - 0x48]
add esp, 0xc
cmp dword [ebp - 0x34], 8
jae 0x42c1c6
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x88]
push edx
or eax, 0x1000b
push eax
push esi
push ecx
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x42c227
cmp eax, 2
je 0x42c227
push eax
lea ecx, [ebp - 0x80]
call fcn.0042783a
pop ecx
push eax
mov byte [ebp - 4], 2
call fcn.0042c291
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.0040c222
add esp, 0xc
mov byte [ebp - 4], 3
lea esi, [ebp - 0x94]
call fcn.00404e30
push 0x4915dc
mov eax, esi
push eax
call fcn.004554bb
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x42c233
lea eax, [ebp - 0x2c]
push eax
push 0x481c08
push dword [ebp - 0x88]
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp eax, esi
je 0x42c275
cmp eax, 2
je 0x42c275
push eax
lea ecx, [ebp - 0x64]
call fcn.0042783a
pop ecx
push eax
mov byte [ebp - 4], 4
call fcn.0042c2fa
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0040c222
add esp, 0xc
mov byte [ebp - 4], 5
jmp 0x42c20f
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.00403c49
push 1
lea esi, [ebp - 0x48]
call fcn.00403c49
call fcn.00455dca
ret

Function at 0x42c291
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3ec4], 1
jne 0x42c2dd
or dword [0x4a3ec4], 1
mov dword [0x4a3618], 0xddf5f7c0
mov dword [0x4a361c], 0xd9fcf7e2
mov dword [0x4a3620], 0xead7ebf7
mov dword [0x4a3624], 0xf4b2bbba
mov dword [0x4a3628], 0xf7fefbf3
mov dword [0x4a362c], 0x92b2a8f6
xor eax, eax
mov cl, byte [eax + 0x4a3618]
xor cl, 0x92
mov byte [eax + 0x4a3da4], cl
inc eax
cmp eax, 0x18
jb 0x42c2df
mov eax, 0x4a3da4
ret

Function at 0x42c2fa
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3ec0], 1
jne 0x42c34d
or dword [0x4a3ec0], 1
mov dword [0x4a3630], 0xf7d6dac1
mov dword [0x4a3634], 0xf7e6f7fe
mov dword [0x4a3638], 0xe7fef3c4
mov dword [0x4a363c], 0xb2bbbaf7
mov dword [0x4a3640], 0xfefbf3f4
mov dword [0x4a3644], 0xb2a8f6f7
mov byte [0x4a3648], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a3630]
xor cl, 0x92
mov byte [eax + 0x4a3dbc], cl
inc eax
cmp eax, 0x19
jb 0x42c34f
mov eax, 0x4a3dbc
ret
Function at 0x42c5b1
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3ebc], 1
jne 0x42c66c
or dword [0x4a3ebc], 1
mov dword [0x4a3650], 0xd6d1d0d3
mov dword [0x4a3654], 0xdad5d4d7
mov dword [0x4a3658], 0xded9d8db
mov dword [0x4a365c], 0xc2dddcdf
mov dword [0x4a3660], 0xc6c1c0c3
mov dword [0x4a3664], 0xcac5c4c7
mov dword [0x4a3668], 0xf0f3c8cb
mov dword [0x4a366c], 0xf4f7f6f1
mov dword [0x4a3670], 0xf8fbfaf5
mov dword [0x4a3674], 0xfcfffef9
mov dword [0x4a3678], 0xe0e3e2fd
mov dword [0x4a367c], 0xe4e7e6e1
mov dword [0x4a3680], 0xe8ebeae5
mov dword [0x4a3684], 0xa1a0a3a2
mov dword [0x4a3688], 0xa5a4a7a6
mov dword [0x4a368c], 0xbdb9abaa
mov byte [0x4a3690], 0x92
xor eax, eax
mov cl, byte [eax + 0x4a3650]
xor cl, 0x92
mov byte [eax + 0x4a3dd8], cl
inc eax
cmp eax, 0x41
jb 0x42c66e
mov eax, 0x4a3dd8
ret

Function at 0x42c719
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, eax
xor edx, edx
push 3
lea eax, [ecx + 2]
pop ebx
div ebx
mov esi, dword [ebp + 0x10]
shl eax, 2
inc eax
cmp dword [esi], eax
jae 0x42c743
mov dword [esi], eax
xor al, al
jmp 0x42c81b
mov eax, ecx
xor edx, edx
push 3
pop ecx
div ecx
mov esi, dword [ebp + 0xc]
mov ecx, dword [0x49e998]
xor edx, edx
imul eax, eax, 3
test eax, eax
je 0x42c7bf
dec eax
push 3
pop ebx
div ebx
inc eax
mov edx, eax
mov dword [ebp - 4], eax
imul edx, edx, 3
movzx eax, byte [edi]
shr eax, 2
mov al, byte [eax + ecx]
mov byte [esi], al
movzx eax, byte [edi + 1]
movzx ebx, byte [edi]
shr eax, 4
shl ebx, 4
add eax, ebx
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 1], al
movzx eax, byte [edi + 2]
movzx ebx, byte [edi + 1]
shr eax, 6
lea eax, [eax + ebx*4]
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 2], al
movzx eax, byte [edi + 2]
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 3], al
add esi, 4
add edi, 3
dec dword [ebp - 4]
jne 0x42c76d
cmp edx, dword [ebp + 8]
jae 0x42c80e
movzx eax, byte [edi]
inc edx
cmp edx, dword [ebp + 8]
jae 0x42c7d3
movzx edi, byte [edi + 1]
jmp 0x42c7d5
xor edi, edi
mov ebx, eax
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + ecx]
mov byte [esi], bl
mov ebx, edi
shr ebx, 4
shl eax, 4
add ebx, eax
and ebx, 0x3f
mov al, byte [ebx + ecx]
mov byte [esi + 1], al
cmp edx, dword [ebp + 8]
jae 0x42c802
and edi, 0xf
mov cl, byte [ecx + edi*4]
jmp 0x42c804
mov cl, 0x3d
mov byte [esi + 2], cl
mov byte [esi + 3], 0x3d
add esi, 4
mov eax, dword [ebp + 0x10]
mov byte [esi], 0
sub esi, dword [ebp + 0xc]
mov dword [eax], esi
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42cfe7
Capabilities:
Encode data using xor

Disassembly:
push 0
mov eax, 0x46ed5b
call fcn.00455cde
and dword [ebp - 4], 0
test byte [0x4a3eb8], 1
jne 0x42d01b
or dword [0x4a3eb8], 1
mov dword [0x4a3e1c], 0xf5f5f5fc
mov dword [0x4a3e20], 0x93e7fffa
xor eax, eax
mov cl, byte [eax + 0x4a3e1c]
xor cl, 0x93
mov byte [eax + 0x4a3e60], cl
inc eax
cmp eax, 8
jb 0x42d01d
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x4a3e60
call esi
mov ebx, eax
test ebx, ebx
jne 0x42d058
or dword [ebp - 4], 0xffffffff
lea esi, [ebp + 8]
call fcn.004151d8
xor eax, eax
jmp 0x42d0fc
call fcn.0042d102
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push ebx
call edi
test eax, eax
je 0x42d045
call fcn.0042d160
push eax
push ebx
call edi
test eax, eax
jne 0x42d045
call fcn.0042d1aa
push eax
call esi
test eax, eax
jne 0x42d045
test byte [0x4a3ea8], 1
jne 0x42d0a5
or dword [0x4a3ea8], 1
mov dword [0x4a3e4c], 0xfbe7f6fd
mov byte [0x4a3e50], 0x93
xor eax, eax
mov cl, byte [eax + 0x4a3e4c]
xor cl, 0x93
mov byte [eax + 0x4a3e90], cl
inc eax
cmp eax, 5
jb 0x42d0a7
push 0x4a3e90
call esi
test eax, eax
je 0x42d045
call fcn.0042d1eb
push eax
call esi
test eax, eax
jne 0x42d045
mov ecx, dword [ebp + 0x18]
test ecx, ecx
jne 0x42d0e7
call fcn.0044c39b
mov eax, dword [ecx]
call dword [eax + 4]
or dword [ebp - 4], 0xffffffff
lea esi, [ebp + 8]
mov edi, eax
call fcn.004151d8
mov eax, edi
call fcn.00455db6
ret

Function at 0x42d102
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3eb4], 1
jne 0x42d143
or dword [0x4a3eb4], 1
mov dword [0x4a3e24], 0xd4ffffd7
mov dword [0x4a3e28], 0xffd0e7f6
mov dword [0x4a3e2c], 0xdce0e0f2
mov dword [0x4a3e30], 0xf0f6f9f1
mov word [0x4a3e34], 0x93e7
xor eax, eax
mov cl, byte [eax + 0x4a3e24]
xor cl, 0x93
mov byte [eax + 0x4a3e68], cl
inc eax
cmp eax, 0x12
jb 0x42d145
mov eax, 0x4a3e68
ret

Function at 0x42d160
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3eb0], 1
jne 0x42d18d
or dword [0x4a3eb0], 1
mov dword [0x4a3e38], 0xdae1f2c5
mov dword [0x4a3e3c], 0xa0e7fafd
mov word [0x4a3e40], 0x93a1
xor eax, eax
mov cl, byte [eax + 0x4a3e38]
xor cl, 0x93
mov byte [eax + 0x4a3e7c], cl
inc eax
cmp eax, 0xa
jb 0x42d18f
mov eax, 0x4a3e7c
ret

Function at 0x42d1aa
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3eac], 1
jne 0x42d1ce
or dword [0x4a3eac], 1
mov dword [0x4a3e44], 0xfef6f7fa
mov dword [0x4a3e48], 0x93f0e5e0
xor eax, eax
mov cl, byte [eax + 0x4a3e44]
xor cl, 0x93
mov byte [eax + 0x4a3e88], cl
inc eax
cmp eax, 8
jb 0x42d1d0
mov eax, 0x4a3e88
ret

Function at 0x42d1eb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4a3ea4], 1
jne 0x42d216
or dword [0x4a3ea4], 1
mov dword [0x4a3e54], 0xe0e1f6e5
mov dword [0x4a3e58], 0xa1a0fffb
mov byte [0x4a3e5c], 0x93
xor eax, eax
mov cl, byte [eax + 0x4a3e54]
xor cl, 0x93
mov byte [eax + 0x4a3e98], cl
inc eax
cmp eax, 9
jb 0x42d218
mov eax, 0x4a3e98
ret
Function at 0x442350
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
xor eax, eax
pop ebp
ret

Function at 0x442440
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x1c]
mov edx, 0x40
cmp eax, edx
jb 0x442459
lea eax, [edx - 0x30]
pop esi
pop ebp
ret
lea ecx, [eax*8]
add dword [esi], ecx
push ebx
mov ebx, 0
adc dword [esi + 4], ebx
push edi
mov byte [eax + esi + 0x20], 0x80
mov edi, 1
add dword [esi + 0x1c], edi
mov eax, dword [esi + 0x1c]
mov ecx, 0x38
cmp eax, ecx
jbe 0x4424b0
cmp eax, edx
jae 0x44249e
lea esp, [esp]
mov byte [eax + esi + 0x20], bl
add dword [esi + 0x1c], edi
mov eax, dword [esi + 0x1c]
cmp eax, edx
jb 0x442490
lea edx, [esi + 0x20]
mov ecx, esi
call fcn.00441d20
mov dword [esi + 0x1c], ebx
mov ecx, 0x38
cmp dword [esi + 0x1c], ecx
jae 0x4424c4
mov edx, dword [esi + 0x1c]
mov byte [esi + edx + 0x20], bl
add dword [esi + 0x1c], edi
cmp dword [esi + 0x1c], ecx
jb 0x4424b5
movzx ecx, byte [esi + 6]
movzx eax, byte [esi + 7]
movzx edx, byte [esi + 5]
mov byte [esi + 0x59], cl
movzx ecx, byte [esi + 3]
mov byte [esi + 0x58], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x5a], dl
movzx edx, byte [esi + 2]
mov byte [esi + 0x5c], cl
movzx ecx, byte [esi]
mov byte [esi + 0x5b], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x5d], dl
mov byte [esi + 0x5f], cl
lea edx, [esi + 0x20]
mov ecx, esi
mov byte [esi + 0x5e], al
call fcn.00441d20
movzx edx, byte [esi + 0xb]
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
movzx ecx, byte [esi + 0xa]
mov byte [eax + 1], cl
movzx edx, byte [esi + 9]
mov byte [eax + 2], dl
movzx ecx, byte [esi + 8]
mov byte [eax + 3], cl
movzx edx, byte [esi + 0xf]
mov byte [eax + 4], dl
movzx ecx, byte [esi + 0xe]
mov byte [eax + 5], cl
movzx edx, byte [esi + 0xd]
mov byte [eax + 6], dl
movzx ecx, byte [esi + 0xc]
mov byte [eax + 7], cl
movzx edx, byte [esi + 0x13]
mov byte [eax + 8], dl
movzx ecx, byte [esi + 0x12]
mov byte [eax + 9], cl
movzx edx, byte [esi + 0x11]
mov byte [eax + 0xa], dl
movzx ecx, byte [esi + 0x10]
mov byte [eax + 0xb], cl
movzx edx, byte [esi + 0x17]
mov byte [eax + 0xc], dl
movzx ecx, byte [esi + 0x16]
mov byte [eax + 0xd], cl
movzx edx, byte [esi + 0x15]
mov byte [eax + 0xe], dl
movzx ecx, byte [esi + 0x14]
mov byte [eax + 0xf], cl
movzx edx, byte [esi + 0x1b]
mov byte [eax + 0x10], dl
movzx ecx, byte [esi + 0x1a]
mov byte [eax + 0x11], cl
movzx edx, byte [esi + 0x19]
mov byte [eax + 0x12], dl
movzx ecx, byte [esi + 0x18]
pop edi
pop ebx
mov byte [eax + 0x13], cl
xor eax, eax
pop esi
pop ebp
ret
Function at 0x442b90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x23c], 0
jne 0x442ce4
mov eax, dword [esi + 0x240]
cmp eax, 0x10
jge 0x442ce4
test eax, eax
js 0x442ce4
mov eax, dword [esi + 0x234]
push eax
call fcn.00445430
add esp, 4
test eax, eax
jne 0x442ce9
mov ecx, dword [esi + 0x240]
mov eax, dword [ebp + 0x10]
lea edx, [ecx + eax]
cmp edx, 0xc
jbe 0x442bea
or dword [esi + 0x238], 1
push ebx
push edi
xor edi, edi
test ecx, ecx
jne 0x442c45
mov ecx, eax
and ecx, 0xfffffff0
mov dword [ebp + 8], ecx
jbe 0x442c3e
lea ebx, [esi + 0x1f4]
xor eax, eax
mov edx, dword [ebp + 0xc]
lea ecx, [eax + edi]
mov ecx, dword [ecx + edx]
xor dword [ebx + eax], ecx
add eax, 4
cmp eax, 0x10
jb 0x442c04
push ebx
push esi
call fcn.00445390
add esp, 8
add dword [esi + 0x248], 0x80
adc dword [esi + 0x24c], 0
add edi, 0x10
cmp edi, dword [ebp + 8]
jb 0x442c02
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
add ebx, edi
jmp 0x442c48
mov ebx, dword [ebp + 0xc]
cmp edi, eax
jae 0x442cdd
sub eax, edi
mov dword [ebp + 8], eax
mov ecx, 1
lea ebx, [ebx]
mov al, byte [ebx]
mov edx, dword [esi + 0x240]
mov byte [esi + edx + 0x224], al
add dword [esi + 0x240], ecx
add ebx, ecx
cmp dword [esi + 0x240], 0x10
jne 0x442cd3
lea edi, [esi + 0x1f4]
mov eax, edi
mov ecx, 4
lea ecx, [ecx]
movzx edx, byte [eax + 0x30]
xor byte [eax], dl
movzx edx, byte [eax + 0x31]
xor byte [eax + 1], dl
movzx edx, byte [eax + 0x32]
xor byte [eax + 2], dl
movzx edx, byte [eax + 0x33]
xor byte [eax + 3], dl
add eax, 4
dec ecx
jne 0x442c90
push edi
push esi
call fcn.00445390
xor eax, eax
add esp, 8
add dword [esi + 0x248], 0x80
mov dword [esi + 0x240], eax
adc dword [esi + 0x24c], eax
mov ecx, 1
sub dword [ebp + 8], ecx
jne 0x442c60
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret
mov eax, 0x10
pop esi
pop ebp
ret
Function at 0x445390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x499520]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
add eax, eax
push 0x10
lea ecx, [ebx + eax*8 + 0x258]
push ecx
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x18], ebx
call fcn.0044fc90
add esp, 0xc
mov esi, 1
mov edx, 0x100
jmp 0x4453d6
mov ebx, dword [ebp - 0x18]
movzx ecx, byte [edi + esi]
add ecx, edx
xor eax, eax
add ecx, ecx
lea ecx, [ebx + ecx*8 + 0x258]
mov ebx, dword [ecx]
xor dword [ebp + eax - 0x14], ebx
add eax, 4
add ecx, 4
cmp eax, 0x10
jl 0x4453e7
add edx, 0x100
inc esi
cmp edx, 0x1000
jl 0x4453d3
push 0x10
lea edx, [ebp - 0x14]
push edx
push edi
call fcn.0044fc90
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044c4ce
mov esp, ebp
pop ebp
ret
Function at 0x445ca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push edi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], edi
cmp eax, edi
je 0x445d44
push esi
mov eax, dword [ebp + 0x10]
dec dword [ebp + 0xc]
test eax, eax
je 0x445cd1
call eax
dec dword [ebp - 8]
call fcn.0045168f
mov esi, eax
call fcn.0045168f
cmp esi, eax
jne 0x445cf0
xor edi, 1
call fcn.0045168f
cmp esi, eax
je 0x445ce4
call fcn.0045168f
mov esi, eax
call fcn.0045168f
cmp esi, eax
jne 0x445d0c
xor ebx, 1
call fcn.0045168f
cmp esi, eax
je 0x445d00
cmp edi, ebx
je 0x445cd4
mov eax, dword [ebp - 4]
lea ecx, [eax + eax]
or ecx, edi
cmp dword [ebp - 8], 0
mov dword [ebp - 4], ecx
jne 0x445cd1
mov eax, dword [ebp + 8]
mov dl, cl
mov byte [eax], dl
inc eax
cmp dword [ebp + 0xc], 0
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 8
jne 0x445cc5
mov eax, dword [ebp - 0xc]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x447ba0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret
Function at 0x447ca0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x28]
mov edx, 0x40
cmp eax, edx
jb 0x447cb9
lea eax, [edx - 0x30]
pop esi
pop ebp
ret
lea ecx, [eax*8]
add dword [esi], ecx
push ebx
mov ebx, 0
adc dword [esi + 4], ebx
push edi
mov byte [eax + esi + 0x2c], 0x80
mov edi, 1
add dword [esi + 0x28], edi
mov eax, dword [esi + 0x28]
mov ecx, 0x38
cmp eax, ecx
jbe 0x447d10
cmp eax, edx
jae 0x447cfe
lea esp, [esp]
mov byte [eax + esi + 0x2c], bl
add dword [esi + 0x28], edi
mov eax, dword [esi + 0x28]
cmp eax, edx
jb 0x447cf0
lea ecx, [esi + 0x2c]
mov edx, esi
call fcn.00445e30
mov dword [esi + 0x28], ebx
mov ecx, 0x38
cmp dword [esi + 0x28], ecx
jae 0x447d24
mov edx, dword [esi + 0x28]
mov byte [esi + edx + 0x2c], bl
add dword [esi + 0x28], edi
cmp dword [esi + 0x28], ecx
jb 0x447d15
movzx ecx, byte [esi + 6]
movzx eax, byte [esi + 7]
movzx edx, byte [esi + 5]
mov byte [esi + 0x65], cl
movzx ecx, byte [esi + 3]
mov byte [esi + 0x64], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x66], dl
movzx edx, byte [esi + 2]
mov byte [esi + 0x68], cl
movzx ecx, byte [esi]
mov byte [esi + 0x67], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x69], dl
mov byte [esi + 0x6b], cl
lea ecx, [esi + 0x2c]
mov edx, esi
mov byte [esi + 0x6a], al
call fcn.00445e30
movzx edx, byte [esi + 0xb]
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
movzx ecx, byte [esi + 0xa]
mov byte [eax + 1], cl
movzx edx, byte [esi + 9]
mov byte [eax + 2], dl
movzx ecx, byte [esi + 8]
mov byte [eax + 3], cl
movzx edx, byte [esi + 0xf]
mov byte [eax + 4], dl
movzx ecx, byte [esi + 0xe]
mov byte [eax + 5], cl
movzx edx, byte [esi + 0xd]
mov byte [eax + 6], dl
movzx ecx, byte [esi + 0xc]
mov byte [eax + 7], cl
movzx edx, byte [esi + 0x13]
mov byte [eax + 8], dl
movzx ecx, byte [esi + 0x12]
mov byte [eax + 9], cl
movzx edx, byte [esi + 0x11]
mov byte [eax + 0xa], dl
movzx ecx, byte [esi + 0x10]
mov byte [eax + 0xb], cl
movzx edx, byte [esi + 0x17]
mov byte [eax + 0xc], dl
movzx ecx, byte [esi + 0x16]
mov byte [eax + 0xd], cl
movzx edx, byte [esi + 0x15]
mov byte [eax + 0xe], dl
movzx ecx, byte [esi + 0x14]
mov byte [eax + 0xf], cl
movzx edx, byte [esi + 0x1b]
mov byte [eax + 0x10], dl
movzx ecx, byte [esi + 0x1a]
mov byte [eax + 0x11], cl
movzx edx, byte [esi + 0x19]
mov byte [eax + 0x12], dl
movzx ecx, byte [esi + 0x18]
mov byte [eax + 0x13], cl
movzx edx, byte [esi + 0x1f]
mov byte [eax + 0x14], dl
movzx ecx, byte [esi + 0x1e]
mov byte [eax + 0x15], cl
movzx edx, byte [esi + 0x1d]
mov byte [eax + 0x16], dl
movzx ecx, byte [esi + 0x1c]
mov byte [eax + 0x17], cl
movzx edx, byte [esi + 0x23]
mov byte [eax + 0x18], dl
movzx ecx, byte [esi + 0x22]
mov byte [eax + 0x19], cl
movzx edx, byte [esi + 0x21]
mov byte [eax + 0x1a], dl
movzx ecx, byte [esi + 0x20]
mov byte [eax + 0x1b], cl
movzx edx, byte [esi + 0x27]
mov byte [eax + 0x1c], dl
movzx ecx, byte [esi + 0x26]
mov byte [eax + 0x1d], cl
movzx edx, byte [esi + 0x25]
mov byte [eax + 0x1e], dl
movzx ecx, byte [esi + 0x24]
pop edi
pop ebx
mov byte [eax + 0x1f], cl
xor eax, eax
pop esi
pop ebp
ret
Function at 0x44c4ce
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x499520]
jne 0x44c4d8
repz ret
jmp fcn.0045705c

Function at 0x462134
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x46215b
call fcn.00451903
mov dword [eax], esi
call fcn.004518f0
push 0x16
pop esi
mov dword [eax], esi
call fcn.004576d8
mov eax, esi
jmp 0x4621b0
test dword [ebp + 0xc], 0xfffffff9
jne 0x462141
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x462188
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00451916
pop ecx
call fcn.004518f0
mov eax, dword [eax]
jmp 0x4621b0
test al, 0x10
jne 0x4621ae
test al, 1
je 0x4621ae
test byte [ebp + 0xc], 2
je 0x4621ae
call fcn.00451903
mov dword [eax], 5
call fcn.004518f0
mov dword [eax], 0xd
jmp 0x46217f
xor eax, eax
pop esi
pop ebp
ret
Function at 0x465acb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x499520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0045a405
and dword [ebp - 0x14], 0
cmp dword [0x49e048], 0
mov dword [ebp - 0x18], eax
jne 0x465b7e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x465c26
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x465c26
mov esi, dword [section..data]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x49e048], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x49e04c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x49e050], eax
call edi
push eax
call esi
mov dword [0x49e058], eax
test eax, eax
je 0x465b7e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x49e054], eax
mov eax, dword [0x49e054]
mov ecx, dword [ebp - 0x18]
mov esi, dword [0x499004]
cmp eax, ecx
je 0x465bd7
cmp dword [0x49e058], ecx
je 0x465bd7
push eax
call esi
push dword [0x49e058]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x465bd7
test ebx, ebx
je 0x465bd7
call edi
test eax, eax
je 0x465bce
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x465bce
test byte [ebp - 8], 1
jne 0x465bd7
or dword [ebp + 0x10], 0x200000
jmp 0x465c0a
mov eax, dword [0x49e04c]
cmp eax, dword [ebp - 0x18]
je 0x465c0a
push eax
call esi
test eax, eax
je 0x465c0a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x465c0a
mov eax, dword [0x49e050]
cmp eax, dword [ebp - 0x18]
je 0x465c0a
push eax
call esi
test eax, eax
je 0x465c0a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x49e048]
call esi
test eax, eax
je 0x465c26
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x465c28
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044c4ce
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219