joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009ad08
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1009ac84
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1009ae80
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1009ae80
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1009ae2f
jg 0x1009ad61
test eax, eax
je 0x1009ae25
push 1
push 0x1000
call fcn.100927d4
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1009ad87
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x1009ae1c
push 0x8000
push ebx
call fcn.1009abb5
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1009adb3
jg 0x1009adae
cmp ecx, 0x1000
jb 0x1009adb3
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1008fac6
add esp, 0x10
cmp eax, 0xffffffff
je 0x1009adf8
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1009adae
jl 0x1009addf
test ecx, ecx
jne 0x1009ada0
push dword [ebp - 0xc]
push ebx
call fcn.1009abb5
push esi
call fcn.10092831
add esp, 0xc
xor edi, edi
jmp 0x1009ae91
cmp byte [edi + 0x24], 0
je 0x1009ae0f
cmp dword [edi + 0x20], 5
jne 0x1009ae0f
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1009ae1a
mov edi, dword [edi + 0x18]
jmp 0x1009ae1c
xor edi, edi
push esi
call fcn.10092831
pop ecx
jmp 0x1009ae91
test ecx, ecx
jg 0x1009adf1
jl 0x1009ae2f
test eax, eax
jae 0x1009adf1
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100899d6
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1009ae52
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x1009adf1
jmp 0x1009ae89
push ebx
call fcn.1009668a
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1009adf1
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x1009ae91
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x1009ae8e
mov edi, dword [edi + 0x18]
jmp 0x1009ae91
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100899d6
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41dbc8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc48
xor eax, eax
mov dword [ebp - 0x3b8], eax
mov dword [ebp - 0x3b4], eax
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x3a8], eax
mov dword [ebp - 0x3ac], eax
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41dd6d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3a4]
xor eax, eax
call fcn.004029a0
mov eax, dword [ebp - 0x3a4]
lea edx, [ebp - 0x3a0]
call fcn.00408148
push dword [ebp - 0x3a0]
lea edx, [ebp - 0x3ac]
xor eax, eax
call fcn.004029a0
mov eax, dword [ebp - 0x3ac]
lea edx, [ebp - 0x3a8]
call fcn.00408210
push dword [ebp - 0x3a8]
push 0x41dd80
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404b0c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00402d44
lea eax, [ebp - 0x1d0]
call fcn.00402ad4
lea eax, [ebp - 0x1d0]
call fcn.00402ee8
lea eax, [ebp - 0x3b0]
call fcn.0041ca9c
lea eax, [ebp - 0x3b0]
mov edx, 0x41dd90
call fcn.00404a54
mov edx, dword [ebp - 0x3b0]
lea eax, [ebp - 0x39c]
call fcn.00402d44
lea eax, [ebp - 0x39c]
call fcn.00402ad4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x39c]
call fcn.00404d90
call fcn.00403558
lea eax, [ebp - 0x39c]
call fcn.00402ee8
push 0
lea eax, [ebp - 0x3b4]
call fcn.0041ca9c
lea eax, [ebp - 0x3b4]
mov edx, 0x41dd90
call fcn.00404a54
mov eax, dword [ebp - 0x3b4]
call fcn.00404c44
push eax
call sub.kernel32.dll_WinExec
push 0x5dc
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x3b8]
call fcn.0041ca9c
lea eax, [ebp - 0x3b8]
mov edx, 0x41dd90
call fcn.00404a54
mov eax, dword [ebp - 0x3b8]
call fcn.004080e0
mov eax, dword [ebp - 4]
call fcn.004080e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dd74
lea eax, [ebp - 0x3b8]
mov edx, 7
call fcn.004047b8
lea eax, [ebp - 4]
call fcn.00404794
ret

Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x60f71bb9
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x64535f7f
nop
nop
nop
nop
test eax, eax
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x44a610
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push 0x653f34
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x44a62d
xor eax, eax
pop ebx
add esp, 0xc
ret
lea eax, [esp + 4]
mov ebx, 1
push eax
push ebx
push 0
push str.CLSIDeb124705_128b_40d4_8dd8_d93ed12589a4InProcServer32
push 0x80000000
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov dword [0xa54230], eax
jne 0x44a6aa
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push 0x653f34
push edx
push eax
mov dword [esp + 0x18], eax
push eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], 0x208
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [0xa54230], eax
jne 0x44a692
cmp dword [esp + 8], ebx
je 0x44a694
xor bl, bl
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x44a6aa
xor eax, eax
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0xa54230]
test ecx, ecx
jne 0x44a6cd
test eax, eax
jle 0x44a6c8
and eax, 0xffff
or eax, 0x80070000
mov dword [0xa54230], eax
mov eax, 0x80004005
pop ebx
add esp, 0xc
ret

Function at 0x493e00
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push str.vb_form_factory_lib_10A6329C_2A3B_3b1c_A846_7D2B5814BF5C
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x493e44
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x493e3a
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
invalid
invalid

Function at 0x4f7d52
Capabilities:
Check for vm using instruction vpcext

Disassembly:
wait
cmpsb byte [esi], byte es:[edi]
dec edi
mov eax, dword [0x4d2ca780]
out 0xaf, eax
dec ebx
pop esp
mov eax, ebx
not edx
sbb ebp, ebp
lahf
cmp ch, byte [edx + 0x29272516]
dec ebx
inc ecx
xor edx, dword [ebx]
cvttps2pi mm4, qword ds:[esi - 0x6493615e]
aaa
in al, dx
inc dword [edx + 0x45]
dec edx
nop
shl ebx, 0xbc
add byte [esi + 0x25], ch
insb byte es:[edi], dx
adc byte [0x75a262de], al
mov bl, bl
or byte [ebp - 0x23], 0x77
lcall 0x1e82, 0x98af3a7b
in eax, dx
sahf
pop ebp
invalid

Function at 0x4f7dca
Capabilities:
Check for vm using instruction vpcext

Disassembly:
jl 0x4f7d78
inc edi
pop ebx
and dword [ebx], ebp
pop ss
pop ebp
or eax, 0x81808c8d
lodsd eax, dword [esi]
inc ebp
fdivr st(1)
adc byte [eax + 0x4c636c0e], bh
not esi
lahf
adc al, 0x2f
nop
inc eax
mov esi, 0xf291a610
out dx, al
aas
leave
scasb al, byte es:[edi]
lodsd eax, dword [esi]
cwde
sti
xor al, 0x9e
insd dword es:[edi], dx
into
sbb eax, 0xc3ecfff
retf 0xa3cf

Function at 0x532d1e
Capabilities:
Encode data using xor

Disassembly:
and dword [edi], edi
mov dl, 0x70
cwde
mov eax, 0x31e2e8f1
add bh, byte [edx + 0x62]
pop esi
imul byte [eax]
sti
mov byte [eax + 0x31b3bd19], ch
les edx, [eax - 0xa]
add eax, 0xd4fc7b53
stc
xor eax, 0x17982893
pop ss
pop ss
xchg ebx, eax
mov eax, 0x9829f77d
loope 0x532cf9
lahf
mov dword [eax + 0x3dd3fd59], ebp
invalid
Function at 0x53945a
Capabilities:
Encode data using xor

Disassembly:
cmp dh, dl
mov ebp, dword [edx]
push esp
or dh, bh
or byte [ebx + 0xc1d01f5], bl
out 0x58, eax
pop ecx
pop esp
wait
xor ebp, dword [edx - 0x35973430]
cmp dh, byte [ebp + 0x11]
enter 0x3ee9, 0xffffffffffffff85
pop ecx
leave
and ebx, ebp
idiv dword [ebp + 0x385c8907]
sub bh, byte [eax - 0x69]
enter 0xffffffffffffa43f, 0x50
jp 0x539449
mov eax, dword [0x32887ecc]
inc esi
xlatb
stc
jge 0x539449
pop eax
jno 0x5394c7
sahf
cdq
cdq
sar byte [0x9872d3fc], 1
cld
inc ebx
outsb dx, byte [esi]
cmp ch, byte [eax - 0x63f767a8]
push 0xffffffffffffffee
loope 0x539417
pop eax
enter 0x6c4f, 0x65
cwde
push 0xad58ab96
adc edi, dword [edx + 0x201d4cb8]
out 0x85, eax
jmp 0x3ec60701
pop ecx
sbb al, 0x2a
out dx, eax
sbb ebx, ebx
sub byte [bp + si], bl
inc edx
sar dword [edx + 0x78c8f80d], 0xe9
mov edx, 0x78c8f80d
jmp 0xd7aa527c
mov al, byte [0xfd756bd]
std
mov dl, bh
mov eax, dword [0xe9f998d9]
dec eax
pushal
pop ebx
stosb byte es:[edi], al
sti
cwde
cmc
stosb byte es:[edi], al
mov ah, 0x12
test eax, 0x99186912
sub al, 0x1e
xor ebx, dword [ecx + 0xc]
add byte [eax], bh
cmp byte [0x91545b42], bh
sub eax, 0xe63cf1b2
imul edi, dword [ecx], 0x7b
mov dh, 0xd3
cli
sahf
mov al, 0x81
nop
js 0x5394d8
push eax
mov ah, 0x88
jbe 0x539538
push esp
mov dword [0xafeb3a71], eax
rcl byte [ecx], 0xeb
and byte [edx - 7], 0x83
jb 0x5394d2
fadd dword [edx - 0x3e]
fdiv qword [ecx - 0x74eea1b0]
push ebx
add eax, ebp
pushfd
or cl, dl
fisubr word [0x27c7c065]
rol bh, 0x27
adc byte [ebx], al
xchg ebp, eax
mov esi, 0x34cd6a0f
adc edx, ecx
invalid

Function at 0x58b324
Capabilities:
Encode data using xor

Disassembly:
mov byte [0x688116cc], al
cmp byte [edi + ebx - 0x6cc20ce3], dh
inc edi
sar byte [0xfe078c63], cl
ror dword [edi], 1
and byte [ebx], 0x93
inc eax
mov word [esi], ss
Function at 0x60e996
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x60e9c7
sub al, 0xb5
js 0x60e9ef
xor esi, dword [edx - 0x15ae1cdf]
int1
wait
dec esp
xor dword [ebx - 0xe247d45], 0xdd670db
mov bl, 0xbb
sbb bl, 0xf1
invalid
movsd dword es:[edi], dword [esi]
push eax
pop esp
aam 0x8b
jae 0x60e976
test byte [eax], ah
je 0x60ea3a
adc eax, 0xcf1b3045
adc dh, byte [ecx + 0xc]
dec ecx
lahf
push cs
jae 0x60e9be
fsincos
invalid
dec esi
cld
jno 0x60ea63
insb byte es:[edi], dx
mov al, 0xa4
jg 0x60ea39
mov cl, 0x8c
push ecx
dec eax
and dword [ebx + 0x5f], eax
lea esp, [edi + 0x3c43769]
int 9
std
pop esp
mov cl, 0x3a
into
add eax, 0x9b2ae125
cmc
cmp al, byte [edx - 0x5c7733d8]
rsqrtps xmm6, xmmword [edi]
sbb eax, 0xe1f1306a
scasb al, byte es:[edi]
jbe 0x60e9b4
mov ch, 0xb0
outsd dx, dword [esi]
mov ebp, 0xc4cd2994
or edx, edx
wait
sbb dword [esi], ecx
add eax, 0x2ddf104e
xchg dword [edx - 0x62], ebx
inc esp
and esp, dword [ecx - 0x6d]
popal
xchg ebx, eax
pop eax
ret
adc ecx, dword [ecx - 0x29707c54]
mov bl, 0x97
leave
and eax, dword [ebx]
shl byte [eax + 0x46510c10], cl
xor dword [esi + 0x31], ebp
pop ebx
add al, 0x15
xchg ecx, eax
salc
add esi, dword [ebx - 0x4d]
add edi, 0xffffff82
outsb dx, byte [esi]
insd dword es:[edi], dx
adc ecx, edx
add al, 0x34
xlatb
fbld tbyte [ecx]
xor esi, dword [eax + 0x22]
ror esi, 0x19
pop edi
or byte [edi + eax*8], bh
or ah, byte [edi + ebp*2 + 0x54]
add dh, byte [edi]
xor edi, dword [ecx]
push edi
and eax, eax
inc edx
out dx, eax
mov dword [0x2a5a0939], eax
cmp byte [ebx - 0x3e506a86], dh
xor dword [ecx], 0x64
salc
invalid

Function at 0x6132fb
Capabilities:
Encode data using xor

Disassembly:
sbb ch, bh
rcl cl, cl
cmp al, 0x81
fisubr word [esi + 0x64c70aec]
dec esp
and dword [edx - 0x1e6fbd48], 0x17
push es
mov al, 0x5f
insb byte es:[edi], dx
push edx
sar ebx, 1
loope 0x613330
nop
fimul dword [ebx - 0x35]
movsb byte es:[edi], byte [esi]
mov ebp, 0xc5217cef
scasb al, byte es:[edi]
inc ebp
jno 0x6132d6
add dword [ebx], 0xd6946998
imul ebp, edx, 0xfffffff5
push esi
mov ebx, 0x92a1ef54
push esi
je 0x6132ba
bound ecx, qword [eax + 0x13]
leave
call 0x82c26089
cdq
xor eax, 0xc7ad29a0
add dl, byte [esi]
aad 0x55
push ebp
xor al, ah
mov al, 0xe8
adc al, 0xd0
jo 0x6132be
call 0x20b3c33f
sub al, dl
sub di, bx
sal byte [ebx], 1
dec eax
insd dword es:[edi], dx
pop eax
xor dword [edx + 0x2613e731], eax
mov ch, ah
or eax, 0xd17a6273
jecxz 0x61330b
shl ebx, 1
fcom dword [edx + 0x1c]
invalid
push edx
sbb al, 0xff
in eax, dx
dec ecx
rol byte [ebx], cl
arpl word [ecx], bp
jns 0x613361
xor byte [ebx + 0x53581781], dl
push eax
fnstcw word [eax - 0x37]
into
pushfd
lock or byte [eax + eax + 0x3f3779bf], 0xc5
mov edx, 0x6b3f6c2c
sbb esp, 0xdf5e0c88
int3
out 0xcb, eax
invalid
Function at 0x616564
Capabilities:
Encode data using xor

Disassembly:
and dword [eax], esi
xchg edi, eax
lea eax, [ebx - 0x7fef8c1c]
pop ebp
salc
mov al, byte [0x2485f12a]
sbb dword [eax], 0xffffffd8
mov cl, 0x93
pop ds
mov dh, 0xf6
test byte [edx - 0x4fb6586e], 0x56
xor dword [ebx + 0x35153d1], 0x19428d31
adc dword [edi + 0x3f], edx
das
jae 0x616507
push ebp
cmp al, 0x8f
pop es
push cs
sahf
rcl ebx, 1
insb byte es:[edi], dx
mov dword [0x22b3d62f], eax
push cs
push es
int1
wait
pop esi
and byte [eax + 0x4f], cl
out 0x45, eax
inc edx
pop ebp
adc ah, byte [edx - 0x7a848a44]
xchg edx, eax
add ecx, dword [esi]
mov eax, dword [0xb4a97be3]
push ebx
jne 0x6165bb
test dword [edx - 0x1c5ef1fd], edx
jnp 0x6164f1
test eax, 0x832053b4
push 0x5878f482
mov ah, 0x53
and byte [ebx + 0x78f48268], al
pop eax
sbb dword [esp + ebx*2], eax
imul esp, dword [ecx + 0x34], 0x26
in eax, 0x6f
shr dword [edi - 0x7abe519e], 1
xlatb
out 0x3e, al
pop eax
mov dword [0xdd100feb], eax
and esp, ecx
xchg edi, eax
outsd dx, dword [esi]
sub esi, eax
mov dh, 0x92
mov dword [ecx - 0x51], eax
jne 0x6165a3
sal cl, 1
adc edx, dword [edx + 0x76]
stc
add al, bl
push eax
iretd
and ah, 0x83
xchg byte [ecx + ecx*2 + 3], bl
jo 0x61653e
mov edx, 0xaa7f314
dec ebx
add ch, byte [esi]
add dl, byte [eax]
add dl, byte es:[eax]
and byte [eax - 0x88827e4], bh
ja 0x6165b4
jbe 0x616547
movd mm3, edi
ror bh, 0xe4
sti
in al, 0xfb
clc
jecxz 0x6165c4
inc edi
sti
sbb byte [eax + 0x51f83d21], bl
jmp 0xca43155a
Function at 0xd85f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xd9a9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xd86002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00d89dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xd86002
lea edx, [esp + 0x14]
push edx
push 0xda0140
call fcn.00d816e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00d8a20b
push 0x10
call fcn.00d8a1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xd85fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00d761c0
jmp 0xd85fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00d85b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xd85ff0
mov ecx, edi
call fcn.00d762c0
push edi
call fcn.00d8a1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xd86021
inc ebx
cmp ebx, 0x20
jb 0xd85f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xd891b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00d89140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00d89140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00d89140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00d89140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xd89230
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x218]
push ebp
mov ebp, dword [esp + 0x218]
push esi
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xd892d6
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea ecx, [esp + 0x14]
push 0x104
push ecx
push eax
push edx
call edi
mov esi, eax
test esi, esi
jne 0xd892ae
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.00d89230
mov esi, eax
add esp, 8
test esi, esi
jne 0xd892ae
lea edx, [esp + 0x14]
push 0x104
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
call edi
mov esi, eax
test esi, esi
je 0xd8927e
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
pop edi
je 0xd892ce
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret

Function at 0xd89bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xd89c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xd9b87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xd89c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xd89c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7ada0966
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xbbe6f18
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x41ce04
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x41d440
call fcn.0041d0c8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x41ce64
cmp eax, 0xffffffff
je 0x41ce64
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x41ce5d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x41ce5d
cmp edx, 0x10000000
jae 0x41ce5d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x41ce5a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x41ced0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x41cf0e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x41cf06
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x41cf10
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x41cef6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x41cfe0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x41d011
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x41d011
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x41d011
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4019f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov dword [0x4040c0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x4019ff
push esp
mov dword [ebp - 0x24], 0x40171b
mov eax, dword [0x4040c0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040c0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040c8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a9e
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a7f
pop ebp
ret 0x10
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0xc84690b
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x44b5bff
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219