joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a7e1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [edi], ecx
jne 0x41a80e
lea ecx, [ebp + 0x13]
call fcn.0041a41e
mov al, byte [eax]
mov byte [ebp + 0xf], al
push 0x44429c
lea eax, [ebp + 0xf]
push eax
call fcn.00430488
mov eax, dword [ebp + 0x10]
sub eax, ecx
je 0x41a85a
dec eax
je 0x41a843
dec eax
je 0x41a82f
lea ecx, [ebp + 0x13]
call fcn.0040fd5d
mov al, byte [eax]
mov byte [ebp + 0xf], al
push 0x4431a8
jmp 0x41a805
mov edx, dword [ebp + 0xc]
push 2
mov ecx, edx
pop esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a83a
jmp 0x41a855
mov edx, dword [ebp + 0xc]
xor esi, esi
mov ecx, edx
inc esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a84e
sub ecx, ebx
inc ecx
jmp 0x41a86e
push dword [ebp + 0xc]
call fcn.004319f4
pop ecx
push 4
pop esi
mov dword [ebp - 4], eax
lea edx, [ebp - 4]
mov ecx, esi
push ecx
push edx
push esi
push 0
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
test eax, eax
je 0x41a8a0
push eax
lea ecx, [ebp + 0x10]
call fcn.0040ec48
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
push 0x442bd0
lea eax, [ebp + 0xc]
jmp 0x41a808
leave
ret 0xc

Function at 0x41b6a2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 8], edi
je 0x41b6ce
lea ecx, [ebp - 1]
call fcn.0041a444
mov al, byte [eax]
mov byte [ebp + 0xb], al
push 0x444264
lea eax, [ebp + 0xb]
push eax
call fcn.00430488
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0xc], eax
test eax, eax
jne 0x41b6fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0xc]
call fcn.0040ec48
mov eax, dword [eax]
mov dword [ebp + 8], eax
push 0x442bd0
lea eax, [ebp + 8]
jmp 0x41b6c8
mov al, byte [ebp + 8]
mov byte [esi + 0x10], al
lea eax, [ebp - 8]
push eax
push edi
push esi
push 0x41b63c
push edi
push edi
mov dword [ebp - 8], edi
call fcn.00433013
add esp, 0x18
push 0xffffffffffffffff
push dword [esi + 0xc]
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], edi
pop edi
pop esi
leave
ret 4
Function at 0x41f1fa
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push esi
xor esi, esi
mov dword [ebp - 4], esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x41f20a
push esi
sub ecx, edx
lea eax, [ebp - 4]
push eax
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
test eax, eax
jne 0x41f255
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp + 8]
call fcn.0040ec48
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
push 0x442bd0
lea eax, [ebp + 0xc]
push eax
call fcn.00430488
leave
ret 8
Function at 0x4223bd
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
mov eax, dword [0x44a7f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x9c
push edi
lea eax, [ebp - 0x2c0]
push 0
push eax
mov esi, ecx
mov bl, 1
call fcn.004311b0
add esp, 0xc
lea eax, [ebp - 0x2c0]
mov dword [ebp - 0x2c0], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call edi
test eax, eax
jne 0x42244b
lea eax, [ebp - 0x2c0]
push eax
mov dword [ebp - 0x2c0], 0x94
call edi
test eax, eax
jne 0x422449
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x2c8]
call fcn.0040ec48
mov eax, dword [eax]
mov dword [ebp - 0x2c4], eax
push 0x442bd0
lea eax, [ebp - 0x2c4]
push eax
call fcn.00430488
xor bl, bl
mov eax, dword [ebp - 0x2bc]
imul eax, eax, 0x64
add eax, dword [ebp - 0x2b8]
mov edi, 0x401964
push eax
push edi
mov dword [esi + 0x24], eax
lea eax, [ebp - 0x1c]
push 0xffffffffffffffff
push eax
call fcn.0040f921
add esp, 0x10
lea eax, [ebp - 0x1c]
push eax
push 0x40782c
mov ecx, esi
call fcn.00420ddd
mov eax, dword [ebp - 0x2b0]
mov ecx, esi
dec eax
je 0x42249e
dec eax
je 0x422497
push 0x407880
jmp 0x4224a3
push 0x407844
jmp 0x4224a3
push 0x407874
push 0x407850
call fcn.00420ddd
test bl, bl
je 0x4224da
movzx ecx, word [ebp - 0x22c]
movzx eax, word [ebp - 0x22a]
imul ecx, ecx, 0x64
add ecx, eax
push ecx
push edi
lea eax, [ebp - 0x1c]
push 0xffffffffffffffff
push eax
call fcn.0040f921
add esp, 0x10
lea eax, [ebp - 0x1c]
push eax
jmp 0x4224df
push 0x4012f8
push 0x407890
mov ecx, esi
call fcn.00420ddd
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
push eax
push edi
lea eax, [ebp - 0x1c]
push 0xffffffffffffffff
push eax
call fcn.0040f921
add esp, 0x10
lea eax, [ebp - 0x1c]
push eax
push 0x4078b0
mov ecx, esi
call fcn.00420ddd
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
push eax
push edi
lea eax, [ebp - 0x1c]
push 0xffffffffffffffff
push eax
call fcn.0040f921
add esp, 0x10
lea eax, [ebp - 0x1c]
push eax
push 0x4078d8
mov ecx, esi
call fcn.00420ddd
call dword [0x44a5dc]
test al, al
mov eax, 0x4014a4
jne 0x422551
mov eax, 0x401e44
push eax
push 0x4078fc
mov ecx, esi
call fcn.00420ddd
call dword [0x44a5e4]
sub eax, 0
je 0x422599
sub eax, 5
je 0x422592
dec eax
je 0x42258b
sub eax, 3
je 0x422584
sub eax, 0xfff6
jne 0x4225aa
push 0x407880
jmp 0x42259e
push 0x407954
jmp 0x42259e
push 0x40795c
jmp 0x42259e
push 0x407968
jmp 0x42259e
push 0x407920
push 0x407928
mov ecx, esi
call fcn.00420ddd
mov edi, 0x104
push edi
lea eax, [ebp - 0x224]
push eax
push 0
call dword [0x44a5c0]
test eax, eax
je 0x42260b
cmp eax, edi
je 0x42260b
lea eax, [ebp - 0x224]
push eax
push 0x407970
mov ecx, esi
call fcn.00420ddd
push 0x407998
push 0x4079a0
mov ecx, esi
call fcn.0042262f
push 0x401c48
push 0x4079b8
mov ecx, esi
call fcn.0042262f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043047a
leave
ret
mov esi, 0x44a350
push 0x405eb8
mov ecx, esi
call fcn.00427776
push 0x401284
mov ecx, esi
call fcn.00427776
push 0x7b
jmp 0x422425
Function at 0x42262f
Capabilities:
Get common file path

Disassembly:
push 0x250
mov eax, 0x4412c8
call fcn.00430573
mov edi, ecx
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push 0x103
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x117]
push ebx
push eax
mov dword [ebp - 0x25c], edi
mov byte [ebp - 0x118], bl
call fcn.004311b0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x4226b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x24c]
call fcn.0040ec48
mov eax, dword [eax]
mov dword [ebp - 0x254], eax
push 0x442bd0
lea eax, [ebp - 0x254]
push eax
call fcn.00430488
push 0xffffffffffffffff
push 0x4079dc
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.004331f6
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x118]
push 0x104
push eax
call fcn.004331f6
add esp, 0x20
mov esi, 0x44a350
push 0x4079e0
mov ecx, esi
call fcn.00427776
lea eax, [ebp - 0x118]
push eax
mov ecx, esi
call fcn.00427776
push 0x401288
mov ecx, esi
call fcn.00427776
push 0x401284
mov ecx, esi
call fcn.00427776
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.00427b07
cmp dword [ebp - 0x120], 0x10
mov eax, dword [ebp - 0x134]
mov byte [ebp - 4], 1
jae 0x42274b
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0x244]
push 3
mov dword [ebp - 0x248], ecx
push eax
lea ecx, [ebp - 0x248]
call fcn.00412281
push dword [ebp - 0x248]
mov ecx, edi
push dword [ebp - 0x24c]
mov byte [ebp - 4], 2
call fcn.00420ddd
lea eax, [ebp - 0x244]
cmp dword [ebp - 0x248], eax
je 0x422796
push dword [ebp - 0x248]
call fcn.0043028c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x134]
call fcn.0040d887
call fcn.004305cc
ret 8
Function at 0x423602
Capabilities:
Query environment variable

Disassembly:
push 0xe0
mov eax, 0x4414c8
call fcn.0043053d
mov dword [ebp - 0xe4], ecx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 7
mov dword [ebp - 0xe0], ebx
pop ecx
xor eax, eax
mov dword [esi + 0x14], ecx
mov dword [esi + 0x10], ebx
mov dword [ebp - 0xec], esi
mov word [esi], ax
xor edx, edx
inc edx
mov dword [ebp - 0xe0], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], ax
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
push 2
pop eax
push 0x104
mov ecx, esi
mov byte [ebp - 4], al
call fcn.0041e9a8
jmp 0x42370c
movzx edx, word [edi]
cmp edx, 0x24
je 0x4236a1
cmp dword [esi + 0x14], 8
jb 0x423682
mov ecx, dword [esi]
jmp 0x423684
mov ecx, esi
mov eax, dword [esi + 0x10]
lea eax, [ecx + eax*2]
push edx
push eax
lea eax, [ebp - 0xe8]
push eax
mov ecx, esi
call fcn.00420074
push 2
pop eax
add edi, eax
jmp 0x42370c
push 2
pop eax
add edi, eax
cmp word [edi], bx
je 0x423719
add edi, eax
cmp word [edi], bx
je 0x423719
push 0x29
push edi
call fcn.004333eb
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x423717
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0x48]
call fcn.0040da21
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x48]
jae 0x4236dc
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0xe4]
push eax
call fcn.00421d0a
test al, al
je 0x423707
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x4236fc
lea eax, [ebp - 0x2c]
push eax
push dword [esi + 0x10]
mov ecx, esi
call fcn.0041ffa0
lea edi, [ebx + 2]
xor ebx, ebx
cmp word [edi], bx
jne 0x423670
jmp 0x423719
xor ebx, ebx
cmp dword [esi + 0x14], 8
jb 0x423723
mov eax, dword [esi]
jmp 0x423725
mov eax, esi
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
test edi, edi
jne 0x423759
push 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0xdc]
call fcn.0040de6b
push 0x4429ac
lea eax, [ebp - 0xdc]
push eax
call fcn.00430488
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004311a5
cmp dword [esi + 0x14], 8
pop ecx
mov ebx, eax
jb 0x42377c
mov eax, dword [esi]
jmp 0x42377e
mov eax, esi
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ebx
mov ecx, esi
call fcn.0040da9d
push ebx
call fcn.00430334
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040dd4b
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.0040dd4b
mov eax, esi
call fcn.004305c0
ret 8
Function at 0x4250fe
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push eax
push eax
push 3
push eax
push eax
push SysReAllocString
push dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x42514a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 8]
call fcn.0040ec48
mov eax, dword [eax]
mov dword [ebp + 8], eax
push 0x442bd0
lea eax, [ebp + 8]
push eax
call fcn.00430488
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x425128
lea eax, [esi + 1]
push eax
call fcn.004311a5
pop ecx
mov dword [ebx], eax
test eax, eax
jne 0x42517a
mov al, byte [ebp + 0xb]
mov byte [ebp + 0xb], al
push 0x445460
lea eax, [ebp + 0xb]
jmp 0x425144
push 0
lea ecx, [ebp - 4]
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x425128
mov eax, dword [ebx]
push edi
mov byte [esi + eax], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x42767b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x44a7f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x108]
push eax
xor ebx, ebx
push 0x103
mov esi, ecx
mov edi, ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4276d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x110]
call fcn.0040ec48
mov eax, dword [eax]
mov dword [ebp - 0x10c], eax
push 0x442bd0
lea eax, [ebp - 0x10c]
push eax
call fcn.00430488
inc edi
push edi
lea eax, [ebp - 0x108]
push eax
push 0x408efc
push 0x103
push esi
call fcn.004277af
add esp, 0x14
test eax, eax
js 0x42772c
push ebx
push ebx
push 1
push ebx
push ebx
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x42771c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x4276d8
jmp 0x42773b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.004275fb
jmp 0x42773b
push 0x408f18
mov ecx, 0x44a350
call fcn.00427776
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043047a
leave
ret
Function at 0x42b23c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.0042a5a4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0042a559
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.0042a594
adc al, 0x7b
jne 0x42b25a
push 0x104
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x42b288
dec dword [ecx - 0x3977b]
inc esi
test dword [edx + edi*8 - 0x7cfe0001], edi
mov ebp, 0xfffffc68
add byte [edi + edx - 0x7d], dh
mov ebp, 0xfffffc68
add byte [edi], cl
test ah, dl
add dword [eax], eax
add byte [ebx + 0xf010c7d], al
test dl, cl
add dword [eax], eax
add byte [ebx + 0xf080c7d], al
test dword [eax - 0x7fffffff], ecx
movsd dword es:[edi], dword [esi]
dec eax
stc
invalid
cmp dword [ebp - 0x398], 0
je 0x42b452
cmp dword [ebp + 0xc], 1
je 0x42b452
cmp dword [ebp + 0xc], 8
jne 0x42b41a
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
mov byte [ebp - 0x6b6], 0x9b
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
mov byte [ebp - 0x6b3], 0x16
mov byte [ebp - 0x6b2], 0xd
mov byte [ebp - 0x6b1], 0x10
mov byte [ebp - 0x6b0], 1
mov byte [ebp - 0x6af], 0x34
mov byte [ebp - 0x6ae], 0x16
mov byte [ebp - 0x6ad], 0xb
mov byte [ebp - 0x6ac], 7
mov byte [ebp - 0x6ab], 1
mov byte [ebp - 0x6aa], 0x17
mov byte [ebp - 0x6a9], 0x17
mov byte [ebp - 0x6a8], 0x29
mov byte [ebp - 0x6a7], 1
mov byte [ebp - 0x6a6], 9
mov byte [ebp - 0x6a5], 0xb
mov byte [ebp - 0x6a4], 0x16
mov byte [ebp - 0x6a3], 0x1d
mov byte [ebp - 0x6a2], 0x64
lea eax, [ebp - 0x6b8]
push eax
call fcn.0042a5a4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0042a559
add esp, 0xc
mov dword [ebp - 0x690], eax
mov byte [ebp - 0x6a0], 0x8b
or byte [ebp - 0x69f], 0xff
mov byte [ebp - 0x69e], 0x55
mov byte [ebp - 0x69d], 0x8b
mov byte [ebp - 0x69c], 0xec
lea eax, [ebp - 0x694]
push eax
push 5
lea eax, [ebp - 0x6a0]
test dword [eax - 7], esp
invalid
call dword [eax - 1]
mov ch, 0xc4
cld
invalid
jmp [edx - 1]
call dword [ebp - 0x690]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x6bc], eax
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x698], eax
call fcn.0042a594
hlt
call fcn.0042a594
scasd eax, dword es:[edi]
push 0xfffffffffffffffc
pop dword [eax - 0x5435b]
inc dword [eax]
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.0042a594
test byte [esi - 0x5a7f2adc], bh
sar ch, 1
invalid
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
invalid
inc dword [eax]

Function at 0x43047a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44a7f0]
jne fcn.0043122a
repz ret
Function at 0x43122a
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x44bad0], eax
mov dword [0x44bacc], ecx
mov dword [0x44bac8], edx
mov dword [0x44bac4], ebx
mov dword [0x44bac0], esi
mov dword [0x44babc], edi
mov word [0x44bae8], ss
mov word [0x44badc], cs
mov word [0x44bab8], ds
mov word [0x44bab4], es
mov word [0x44bab0], fs
mov word [0x44baac], gs
pushfd
pop dword [0x44bae0]
mov eax, dword [ebp]
mov dword [0x44bad4], eax
mov eax, dword [ebp + 4]
mov dword [0x44bad8], eax
lea eax, [ebp + 8]
mov dword [0x44bae4], eax
mov eax, dword [ebp - 0x320]
mov dword [0x44ba20], 0x10001
mov eax, dword [0x44bad8]
mov dword [0x44b9d4], eax
mov dword [0x44b9c8], 0xc0000409
mov dword [0x44b9cc], 1
mov eax, dword [0x44a7f0]
mov dword [ebp - 0x328], eax
mov eax, dword [0x44a7f4]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x44ba18], eax
push 1
call fcn.00437ffa
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x409d48
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x44ba18], 0
jne 0x431316
push 1
call fcn.00437ffa
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret

Function at 0x43141e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x431445
call fcn.00435337
mov dword [eax], esi
call fcn.00435324
push 0x16
pop esi
mov dword [eax], esi
call fcn.004364bc
mov eax, esi
jmp 0x43149a
test dword [ebp + 0xc], 0xfffffff9
jne 0x43142b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x431472
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043534a
pop ecx
call fcn.00435324
mov eax, dword [eax]
jmp 0x43149a
test al, 0x10
jne 0x431498
test al, 1
je 0x431498
test byte [ebp + 0xc], 2
je 0x431498
call fcn.00435337
mov dword [eax], 5
call fcn.00435324
mov dword [eax], 0xd
jmp 0x431469
xor eax, eax
pop esi
pop ebp
ret
Function at 0x43a3ba
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44a7f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00434964
and dword [ebp - 0x14], 0
cmp dword [0x44c5f0], 0
mov dword [ebp - 0x18], eax
jne 0x43a46d
push 0x40ac94
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x43a515
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4095b0
push ebx
call edi
test eax, eax
je 0x43a515
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x40ac84
push ebx
mov dword [0x44c5f0], eax
call edi
push eax
call esi
push 0x40ac70
push ebx
mov dword [0x44c5f4], eax
call edi
push eax
call esi
push 0x40ac54
push ebx
mov dword [0x44c5f8], eax
call edi
push eax
call esi
mov dword [0x44c600], eax
test eax, eax
je 0x43a46d
push 0x40ac3c
push ebx
call edi
push eax
call esi
mov dword [0x44c5fc], eax
mov eax, dword [0x44c5fc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x43a4c6
cmp dword [0x44c600], ecx
je 0x43a4c6
push eax
call esi
push dword [0x44c600]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x43a4c6
test ebx, ebx
je 0x43a4c6
call edi
test eax, eax
je 0x43a4bd
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x43a4bd
test byte [ebp - 8], 1
jne 0x43a4c6
or dword [ebp + 0x10], 0x200000
jmp 0x43a4f9
mov eax, dword [0x44c5f4]
cmp eax, dword [ebp - 0x18]
je 0x43a4f9
push eax
call esi
test eax, eax
je 0x43a4f9
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x43a4f9
mov eax, dword [0x44c5f8]
cmp eax, dword [ebp - 0x18]
je 0x43a4f9
push eax
call esi
test eax, eax
je 0x43a4f9
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44c5f0]
call esi
test eax, eax
je 0x43a515
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x43a517
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043047a
leave
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xa4a2242
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
mov eax, section..rsrc
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x57345f97
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219