joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a3580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xd
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.005beb40
add esp, 0xc
jns 0x5a359b
jne 0x5a35ae
pushf
xor edx, dword [esp]
xor edx, dword [esp]
popf
jae 0x5a35a9
mov ebx, ebx
je 0x5a35ae
mov edi, 0x45c666b0
invalid
mov al, 0x66
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], 0x75
mov byte [ebp - 0xd], 0x4d
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0xb], 0x64
mov byte [ebp - 0xa], 0x62
mov byte [ebp - 9], 0x6d
mov byte [ebp - 8], 0x55
mov byte [ebp - 7], 0x6a
mov byte [ebp - 6], 0x6e
mov byte [ebp - 5], al
mov byte [ebp - 4], 0
jmp 0x5a35e4
nop
je 0x5a35ef
xchg esp, esp
jne 0x5a35eb
jne 0x5a35ef
mov ebx, 0xf04d8a43
mov cl, byte [ebp - 0x10]
mov al, byte [ebp - 0xb]
mov bl, byte [ebp - 6]
mov dl, byte [ebp - 0xf]
dec cl
dec al
mov byte [ebp - 0x10], cl
mov cl, byte [ebp - 0xa]
dec bl
mov byte [ebp - 0xb], al
mov al, byte [ebp - 5]
dec dl
mov byte [ebp - 6], bl
mov bl, byte [ebp - 0xe]
mov byte [ebp - 0xf], dl
mov dl, byte [ebp - 9]
dec cl
dec al
mov byte [ebp - 0xa], cl
mov cl, byte [ebp - 0xd]
dec bl
mov byte [ebp - 5], al
mov al, byte [ebp - 8]
dec dl
mov byte [ebp - 0xe], bl
mov bl, byte [ebp - 0xc]
mov byte [ebp - 9], dl
mov dl, byte [ebp - 7]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 0xd], cl
mov byte [ebp - 8], al
mov byte [ebp - 0xc], bl
mov byte [ebp - 7], dl
call fcn.005a3550
test eax, eax
je 0x5a36d2
stc
shl ecx, 0
jae 0x5a3663
mov ecx, ecx
jb 0x5a3663
sub eax, 0x51f04d8d
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.005a6d20
push 0xd
lea edx, [ebp - 0x10]
push 0
push edx
mov edi, eax
call fcn.005beb40
add esp, 0xc
test edi, edi
je 0x5a36d2
jge 0x5a3685
lea eax, [eax]
jp 0x5a369d
pushf
or esp, 0
xor esi, ebx
xor esi, ebx
jg 0x5a3694
popf
xchg ebx, ebx
jae 0x5a369a
jnp 0x5a369d
sub eax, 0xcc4de857
add dword [eax], eax
push edi
call fcn.005c02f0
add esp, 4
sub esp, 0
cmp ecx, 0x7e42
jne 0x5a36b1
je 0x5a36b3
jle 0x5a36cc
pushf
jno 0x5a36b9
xor eax, 0x3bbe
xor eax, 0x3bbe
popf
mov edx, edx
jne 0x5a36c9
jg 0x5a36cc
xor eax, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5a6d20
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x5a6da1
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x5a6da1
ror esi, 0x18
rol esi, 0x18
shr eax, 0
jnp 0x5a6d3f
jae 0x5a6d48
jle 0x5a6d43
nop
jb 0x5a6d48
mov ebp, 0xf981e4
add byte [ecx], al
add byte [ebx + 0x15], dh
cmp ecx, 0x10000
jae 0x5a6d65
mov eax, eax
jb 0x5a6d54
jne 0x5a6d5c
jne 0x5a6d58
je 0x5a6d5c
mov ebp, 0xe8535148
mov ebp, 0xeb000091
adc eax, 0x97ffe283
push ecx
push ebx
call 0x5aff20
jmp 0x5a6d7a
and edx, 0xffffffff
xchg edi, eax
xchg edi, eax
ja 0x5a6d73
jle 0x5a6d6e
jl 0x5a6d70
jbe 0x5a6d73
mov ebx, 0x36e85351
js 0x5a6d7a
push ecx
push ebx
call fcn.005be5b0
add byte [ebx - 0x3f7af73c], al
add esp, 8
test eax, eax
je 0x5a6dac
push edx
pop edx
jl 0x5a6d85
jp 0x5a6d9a
js 0x5a6d89
jg 0x5a6d8b
lea edi, [edi + 0xc35]
lea edi, [edi - 0xc35]
jnp 0x5a6d9a
call 0x5db5cbfd
pop edi
pop esi
pop ebx
pop ebp
ret 8
push 0x59e4cc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8

Function at 0x5a7430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x11
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.005beb40
add esp, 0xc
jo 0x5a744b
je 0x5a744d
cmp edi, 0x4478
push ecx
pop ecx
jl 0x5a745f
xchg edi, ecx
xchg edi, ecx
nop
jge 0x5a745f
sub eax, 0x76b166b0
mov al, 0x66
mov cl, 0x76
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x1b], al
mov byte [ebp - 0x1a], 0x68
mov byte [ebp - 0x19], 0x52
mov byte [ebp - 0x18], cl
mov byte [ebp - 0x17], al
mov byte [ebp - 0x16], 0x73
mov byte [ebp - 0x15], 0x7a
mov byte [ebp - 0x14], 0x57
mov byte [ebp - 0x13], 0x62
mov byte [ebp - 0x12], 0x6d
mov byte [ebp - 0x11], cl
mov byte [ebp - 0x10], al
mov byte [ebp - 0xf], 0x46
mov byte [ebp - 0xe], 0x79
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 0xc], 0
jg 0x5a74a4
sub esi, 0
xchg esp, esp
jle 0x5a74c4
pushf
jmp 0x5a74af
and esp, 0xffffffff
jmp 0x5a74b4
call fcn.005a74b9
Function at 0x5ad1e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0xe
lea eax, [ebp - 0x10]
push 0
push eax
call fcn.005beb40
add esp, 0xc
or esp, 0
js 0x5ad211
xchg edi, edi
jno 0x5ad202
lea edx, [edx + 0x4cf4]
lea edx, [edx - 0x4cf4]
jns 0x5ad211
xor dword [ecx - 0x398a4f9a], 0xc67af445
inc ebp
invalid
mov cl, 0x66
mov al, 0x75
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x10], 0x48
mov byte [ebp - 0xf], cl
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 7], 0x4a
mov byte [ebp - 8], 0x6e
mov byte [ebp - 5], 0x67
mov byte [ebp - 0xa], al
mov byte [ebp - 3], 0
mov byte [ebp - 0xe], al
mov byte [ebp - 4], 0x70
mov byte [ebp - 0xd], 0x54
mov byte [ebp - 9], cl
mov byte [ebp - 6], 0x6f
add edx, 0x4dfb
sub edx, 0x4dfb
jne 0x5ad260
lea esp, [esp]
jmp 0x5ad25c
je 0x5ad260
mov edx, 0xfc4d8aad
mov cl, byte [ebp - 4]
mov al, byte [ebp - 0xb]
mov bl, byte [ebp - 0xf]
mov dl, byte [ebp - 0xd]
dec cl
dec al
mov byte [ebp - 4], cl
mov cl, byte [ebp - 9]
dec bl
mov byte [ebp - 0xb], al
mov al, byte [ebp - 0xc]
dec dl
mov byte [ebp - 0xf], bl
mov bl, byte [ebp - 0xa]
dec cl
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 6]
mov byte [ebp - 9], cl
mov cl, byte [ebp - 8]
dec al
dec bl
mov byte [ebp - 0xc], al
mov al, byte [ebp - 0x10]
dec dl
mov byte [ebp - 0xa], bl
mov bl, byte [ebp - 7]
dec cl
mov byte [ebp - 6], dl
mov dl, byte [ebp - 5]
mov byte [ebp - 8], cl
mov cl, byte [ebp - 0xe]
dec al
dec bl
dec dl
dec cl
mov byte [ebp - 0x10], al
mov byte [ebp - 7], bl
mov byte [ebp - 5], dl
mov byte [ebp - 0xe], cl
mov edx, edx
je 0x5ad2e1
mov eax, eax
lea ebx, [ebx + 0x1933]
lea ebx, [ebx - 0x1933]
jl 0x5ad2dc
jbe 0x5ad2de
jne 0x5ad2e1
add eax, 0xff626ae8
dec dword [ebx + 0xff685f0]
test byte [edi - 0x3f000000], dh
loopne 0x5ad2f3
call fcn.005a3550
mov esi, eax
test esi, esi
je 0x5ad3a7
shl eax, 0
rol ecx, 0
jno 0x5ad31d
pushf
xor eax, dword [esp + 4]
xor eax, dword [esp + 4]
jl 0x5ad304
call fcn.005ad309
Function at 0x5b1a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x59e298]
push ebx
push esi
cmp eax, 1
push edi
jne 0x5b1be6
push 0xd
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.005beb40
add esp, 0xc
and esi, 0xffffffff
js 0x5b1abc
test esi, 0x679c
js 0x5b1acd
jl 0x5b1ac6
jb 0x5b1ac8
jno 0x5b1aca
jns 0x5b1acd
lcall 0x48ec, 0x45c675b0
mov al, 0x75
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 9], al
mov byte [ebp - 0x12], al
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 8], 0
mov byte [ebp - 0x11], 0x55
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x10], 0x6a
mov byte [ebp - 0xb], 0x76
ja 0x5b1b03
jp 0x5b1b05
xchg edx, edi
xchg edx, edi
js 0x5b1b1c
jle 0x5b1b0d
lea esi, [esi + 0x3c30]
lea esi, [esi - 0x3c30]
jns 0x5b1b1c
mov ecx, 0x8aec4d8a
inc ebp
int1
mov cl, byte [ebp - 0x14]
mov al, byte [ebp - 0xf]
mov bl, byte [ebp - 0xa]
mov dl, byte [ebp - 0x13]
dec cl
dec al
mov byte [ebp - 0x14], cl
mov cl, byte [ebp - 0xe]
dec bl
mov byte [ebp - 0xf], al
mov al, byte [ebp - 9]
dec dl
mov byte [ebp - 0xa], bl
mov bl, byte [ebp - 0x12]
mov byte [ebp - 0x13], dl
mov dl, byte [ebp - 0xd]
dec cl
dec al
mov byte [ebp - 0xe], cl
mov cl, byte [ebp - 0x11]
dec bl
mov byte [ebp - 9], al
mov al, byte [ebp - 0xc]
dec dl
mov byte [ebp - 0x12], bl
mov bl, byte [ebp - 0x10]
mov byte [ebp - 0xd], dl
mov dl, byte [ebp - 0xb]
dec cl
dec al
dec bl
dec dl
mov byte [ebp - 0x11], cl
mov byte [ebp - 0xc], al
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xb], dl
rol esi, 0x12
rol esi, 0xe
jnp 0x5b1b84
jne 0x5b1b8e
jge 0x5b1b88
jne 0x5b1b8a
je 0x5b1b8e
ljmp 0xffff:0x19bde8c5
call fcn.005a3550
test eax, eax
jne 0x5b1ba0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ecx + 0x6985]
sub ecx, 0x6985
jg 0x5b1bae
jae 0x5b1bbb
pushf
jl 0x5b1bb4
popf
mov edx, edx
jb 0x5b1bbb
or dword [ebp + 0x5051ec4d], 0xff515be8
jmp [edx + 0xd]
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.005a6d20
push 0xd
lea edx, [ebp - 0x14]
mov esi, eax
push 0
push edx
mov dword [ebp - 4], esi
call fcn.005beb40
add esp, 0xc
test esi, esi
je 0x5b1b97
mov dword [0x59e298], esi
jmp 0x5b1be9
mov dword [ebp - 4], eax
mov edx, edx
ror edi, 0x1c
rol edi, 0x1c
rol ebx, 0x13
ror ebx, 0x13
jp 0x5b1c0c
pushf
or eax, eax
xor edi, 0
lea esp, [esp]
popf
xchg esi, edi
xchg esi, edi
jnp 0x5b1c0c
mov eax, 0x53fc5d8b
mov ebx, dword [ebp - 4]
push ebx
call fcn.005c02f0
add esp, 4
shr ecx, 0
shl esp, 0
xor eax, dword [esp + 4]
xor eax, dword [esp + 4]
xor ecx, dword [esp]
xor ecx, dword [esp]
ja 0x5b1c4a
pushf
nop
push edi
add edi, 0x10b8
ror edi, 0x16
pop edi
or esi, 0
popf
ja 0x5b1c43
jne 0x5b1c45
jl 0x5b1c47
jbe 0x5b1c4a
add eax, 0x5e5fd3ff
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5b60d0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0
push 0x59e448
call fcn.005b4350
add esp, 0xc
mov byte [0x59e448], 0x80
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x5b6b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x13
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.005beb40
add esp, 0xc
jae 0x5b6b7b
jnp 0x5b6b91
pushf
jg 0x5b6b81
jg 0x5b6b83
lea esp, [esp]
popf
lea esi, [esi]
jge 0x5b6b8c
jns 0x5b6b8e
jp 0x5b6b91
add eax, 0x66b06db1
mov cl, 0x6d
mov al, 0x66
mov byte [ebp - 0x14], 0x44
mov byte [ebp - 0xf], 0x54
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 5], 0x65
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xe], al
mov byte [ebp - 9], al
mov byte [ebp - 4], cl
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 8], 0x49
mov byte [ebp - 3], al
mov byte [ebp - 0x11], 0x74
mov byte [ebp - 0xc], 0x77
mov byte [ebp - 7], 0x62
mov byte [ebp - 2], 0
mov byte [ebp - 0x10], al
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 6], 0x6f
test dword [esp], ecx
lea ecx, [ecx + 0x1fed]
lea ecx, [ecx - 0x1fed]
call 0x5b6bef
add esp, 4
xchg ecx, eax
xchg ecx, eax
je 0x5b6c12
pushf
cmp esi, dword [esp]
not ecx
not ecx
lea esi, [esi + 0x4051]
lea esi, [esi - 0x4051]
popf
js 0x5b6c0f
jne 0x5b6c12
xor eax, 0x8aec558a
dec ebp
int1
mov dl, byte [ebp - 0x14]
mov cl, byte [ebp - 0xf]
mov al, byte [ebp - 0xa]
mov bl, byte [ebp - 5]
dec dl
dec cl
mov byte [ebp - 0x14], dl
mov dl, byte [ebp - 0x13]
dec al
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 0xe]
dec bl
mov byte [ebp - 0xa], al
mov al, byte [ebp - 9]
mov byte [ebp - 5], bl
mov bl, byte [ebp - 4]
dec dl
dec cl
mov byte [ebp - 0x13], dl
mov dl, byte [ebp - 0x12]
dec al
mov byte [ebp - 0xe], cl
mov cl, byte [ebp - 0xd]
dec bl
mov byte [ebp - 9], al
mov al, byte [ebp - 8]
mov byte [ebp - 4], bl
mov bl, byte [ebp - 3]
dec dl
dec cl
mov byte [ebp - 0x12], dl
mov dl, byte [ebp - 0x11]
dec al
mov byte [ebp - 0xd], cl
mov cl, byte [ebp - 0xc]
dec bl
mov byte [ebp - 8], al
mov al, byte [ebp - 7]
mov byte [ebp - 3], bl
mov bl, byte [ebp - 0x10]
dec dl
dec cl
dec al
dec bl
mov byte [ebp - 0x11], dl
mov dl, byte [ebp - 0xb]
mov byte [ebp - 0xc], cl
mov byte [ebp - 7], al
mov byte [ebp - 0x10], bl
mov cl, byte [ebp - 6]
dec dl
dec cl
mov byte [ebp - 0xb], dl
mov byte [ebp - 6], cl
or esp, 0
xchg ecx, ecx
jnp 0x5b6caf
jns 0x5b6cab
jp 0x5b6caf
mov esp, 0xd2cce867
add byte [eax], al
call fcn.005c3f80
mov edx, eax
test edx, edx
jne 0x5b6cc3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xchg esi, esi
xor eax, 0
shr eax, 0
jb 0x5b6ce0
pushf
not ecx
not ecx
ror edi, 1
rol edi, 1
jmp 0x5b6cd9
popf
mov esi, esi
jae 0x5b6ce0
mov eax, 0x51ec4d8d
lea ecx, [ebp - 0x14]
push ecx
push edx
call fcn.005a6d20
push 0x13
lea edx, [ebp - 0x14]
push 0
push edx
mov esi, eax
call fcn.005beb40
add esp, 0xc
test esi, esi
jne 0x5b6d0b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmc
xchg ecx, ecx
ja 0x5b6d17
jbe 0x5b6d12
jle 0x5b6d14
jbe 0x5b6d17
lcall 0, 0x95d3e856
push esi
call fcn.005c02f0
add esp, 4
cmp edx, ecx
std
cld
shl esp, 0
jnp 0x5b6d34
xchg ebx, eax
xchg ebx, eax
jle 0x5b6d2d
jnp 0x5b6d2f
ja 0x5b6d31
jp 0x5b6d34
mov ecx, 0x5008458b
mov eax, dword [ebp + 8]
push eax
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5b8810
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x59ed80]
push esi
push edi
push eax
push 0x59ec2d
mov byte [0x59ec2c], 0x45
call fcn.005b4620
mov edx, dword [0x59ed80]
mov al, 0x2d
mov byte [0x59ec32], al
mov byte [0x59ec33], al
lea eax, [edx + 0x4ed1567b]
mov cl, 0x20
lea edx, [edx + edx*4]
add esp, 8
mov byte [0x59ec31], cl
mov byte [0x59ec34], cl
mov esi, 0x59ec35
xor ecx, ecx
lea edi, [edx + edx*4]
mov edx, eax
imul eax, eax, 0x1003411d
shr edx, 9
add edx, 0x79d11093
xor eax, edx
mov dl, byte [ecx + edi*8 + 0x58ea69]
xor dl, al
mov byte [esi], dl
inc esi
inc ecx
cmp ecx, 0xc8
jl 0x5b885f
mov byte [esi], 0
pop edi
mov eax, 0x59ec2c
pop esi
ret
Function at 0x5c14f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xf
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.005beb40
add esp, 0xc
lea ecx, [ecx]
jns 0x5c1526
pushf
xchg esp, esp
popf
xchg esp, esp
lea edi, [edi + 0x617]
lea edi, [edi - 0x617]
js 0x5c1523
js 0x5c1526
sub eax, 0x72b173b0
mov al, 0x73
mov cl, 0x72
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x50
mov byte [ebp - 0xf], al
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 0x13], cl
mov byte [ebp - 0xe], al
mov byte [ebp - 9], cl
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0xd], 0x33
mov byte [ebp - 8], al
mov byte [ebp - 0x11], 0x63
mov byte [ebp - 0xc], 0x32
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xb], 0x46
mov byte [ebp - 7], 0x74
call fcn.005a3550
test eax, eax
jne 0x5c1573
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.005a6d20
push 0xf
lea edx, [ebp - 0x14]
mov esi, eax
push 0
push edx
mov dword [ebp - 4], esi
call fcn.005beb40
add esp, 0xc
test esi, esi
jne 0x5c15a1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
rol edi, 2
ror edi, 2
sub esp, 0
jno 0x5c15b3
xchg edx, eax
xchg edx, eax
jb 0x5c15b0
jo 0x5c15b3
xor eax, 0xed37e856
invalid
push esi
call fcn.005c02f0
add esp, 4
push esi
pop esi
jnp 0x5c15d3
pushf
inc ebx
dec ebx
test ecx, 0x580c
popf
xchg edx, ebx
xchg edx, ebx
jp 0x5c15d3
or dword [ebx + 0x4d8b0c45], 0xff515008
push ebp
cld
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x438c9f
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x438a14
sub edx, esi
and edx, edx
add esi, 0xe9f41a18
call fcn.00438cdb
or esi, esi
xor dword [ebx], edi
or edx, edx
add esi, 0x8856d953
add edx, edx
inc ebx
push esi
pop esi
and edx, esi
inc edx
cmp ebx, eax
jne fcn.00438c9f
sub edx, 0x123ce4a7
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x4a043f]
shl eax, 2
mov dword [0x4a0443], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00459c04
pop edx
call fcn.00459b68
call fcn.00459c44
push 0
call fcn.0045af18
pop ecx
push 0x4a03e8
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4a0447], eax
push 0
jmp fcn.0045ffdc
Function at 0x406314
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffbf0
mov ebx, eax
xor eax, eax
mov dword [esp + 0xc], eax
cmp dword [ebx + 0x4f0], 0
jne 0x406338
mov eax, 1
jmp 0x406503
mov esi, 0x4a21e6
lea edi, [esp + 0x10]
mov eax, edi
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp dword [0x4a43e4], 0
je 0x406420
push esp
push 0x2001f
push 0
lea edx, [esp + 0x1c]
push edx
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4063c2
mov dword [esp + 4], 4
mov dword [esp + 8], 4
lea ecx, [esp + 8]
push ecx
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0xc]
push edx
push 0
push 0x4a21ff
mov ecx, dword [esp + 0x14]
push ecx
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4063b9
mov eax, dword [esp]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [esp + 0xc]
jmp 0x406503
mov edx, dword [esp]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
push esp
lea ecx, [esp + 0x14]
push ecx
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x4064ff
mov dword [esp + 0xc], 1
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4a220a
mov edx, dword [esp + 0x14]
push edx
call sub.ADVAPI32.DLL_RegSetValueExA
test eax, eax
jne 0x406412
mov ecx, dword [esp]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [esp + 0xc]
jmp 0x406503
mov edx, dword [esp]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x4064ff
push esp
push 0x2001f
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x40648a
mov dword [esp + 4], 4
mov dword [esp + 8], 4
lea eax, [esp + 8]
push eax
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x4a2215
mov eax, dword [esp + 0x14]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x406481
mov edx, dword [esp]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [esp + 0xc]
jmp 0x406503
mov edx, dword [esp]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
push esp
lea ecx, [esp + 0x14]
push ecx
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x4064ff
mov dword [esp + 0xc], 1
mov edx, 0x4a09dc
mov eax, dword [ebx + 0x4e8]
cmp edx, eax
je 0x4064c3
cmp eax, 0x4a0994
je 0x4064c3
cmp eax, 0x4a0a24
jne 0x4064c9
xor ecx, ecx
mov dword [esp + 0xc], ecx
push 4
lea eax, [esp + 0x10]
push eax
push 4
push 0
push 0x4a2220
mov edx, dword [esp + 0x14]
push edx
call sub.ADVAPI32.DLL_RegSetValueExA
test eax, eax
jne 0x4064f6
mov ecx, dword [esp]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [esp + 0xc]
jmp 0x406503
mov edx, dword [esp]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [esp + 0xc]
add esp, 0x410
pop edi
pop esi
pop ebx
ret
Function at 0x4088bc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov eax, 0x4a3320
call fcn.0045a304
mov dword [ebp - 0x38], ebx
mov edx, dword [0x4b0960]
push 0xa
push esi
mov ecx, dword [edx]
push ecx
call sub.KERNEL32.DLL_FindResourceA
mov esi, eax
test esi, esi
jne 0x4088fb
mov eax, dword [ebp - 0x34]
mov dword fs:[0], eax
jmp 0x4089fb
push esi
mov edx, dword [0x4b0960]
mov ecx, dword [edx]
push ecx
call sub.KERNEL32.DLL_SizeofResource
mov ebx, eax
mov eax, dword [0x4b0960]
push esi
mov edx, dword [eax]
push edx
call sub.KERNEL32.DLL_LoadResource
test eax, eax
jne 0x40892f
mov ecx, dword [ebp - 0x34]
mov dword fs:[0], ecx
mov eax, ecx
jmp 0x4089fb
push eax
call sub.KERNEL32.DLL_LockResource
mov edi, eax
mov dl, 1
mov eax, dword [0x445be8]
call fcn.00408a04
mov esi, eax
mov ecx, ebx
mov edx, edi
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 8]
xor edx, edx
mov eax, esi
call fcn.00448b5c
mov dl, 1
mov eax, dword [0x474b44]
call fcn.00474dd0
mov ebx, eax
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, eax
mov eax, dword [ebp - 0x38]
call fcn.004398b8
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, dword [ebp - 0x38]
call fcn.004398d8
mov eax, dword [ebp - 0x38]
add eax, 0x128
mov eax, dword [eax]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 8]
mov edi, esi
mov dword [ebp - 8], edi
test edi, edi
je 0x4089ca
mov eax, dword [edi]
mov dword [ebp - 4], eax
mov word [ebp - 0x24], 0x14
mov edx, 3
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x24], 8
mov esi, ebx
mov dword [ebp - 0x10], esi
test esi, esi
je 0x4089f1
mov eax, dword [esi]
mov dword [ebp - 0xc], eax
mov word [ebp - 0x24], 0x2c
mov edx, 3
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x24], 0x20
mov edx, dword [ebp - 0x34]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409ff0
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor ebp, ebp
mov dword [esp], ecx
mov dword [ebx], edx
mov eax, dword [esp]
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x20]
cmp dword [eax + 0x104], 0
jne 0x40a019
xor eax, eax
jmp 0x40a09d
cmp byte [eax + 0x108], 1
jne 0x40a032
mov dword [ebx + 0x18], 0x4a4684
mov dword [ebx + 0x1c], 0xd
jmp 0x40a040
mov dword [ebx + 0x18], 0x4a45ac
mov dword [ebx + 0x1c], 9
xor esi, esi
jmp 0x40a06b
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov edi, eax
lea eax, [esi + esi*2]
mov edx, dword [ebx + 0x18]
test edi, edi
lea ecx, [esi + esi*2]
mov dword [edx + eax*8], edi
mov eax, dword [ebx + 0x18]
jne 0x40a06a
xor eax, eax
jmp 0x40a09d
inc esi
cmp esi, dword [ebx + 0x1c]
jb 0x40a044
mov eax, ebx
call fcn.0040a0fc
lea edx, [esp + 4]
push edx
push 0
push ebx
push 0x40a210
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov esi, eax
mov dword [ebx + 0x14], esi
test esi, esi
je 0x40a09b
mov ebp, 1
mov eax, ebp
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40c868
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffbf8
mov ebx, eax
mov esi, 0x4aa778
lea edi, [esp + 8]
mov dword [esp], edx
mov eax, edi
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edx, [esp + 4]
push edx
push 0x2001f
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x40c8d8
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push ebx
mov edx, dword [esp + 0x18]
push edx
call sub.ADVAPI32.DLL_RegSetValueExA
test eax, eax
jne 0x40c8ce
mov ecx, dword [esp + 4]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x40c920
mov eax, dword [esp + 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
lea edx, [esp + 4]
push edx
lea ecx, [esp + 0xc]
push ecx
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x40c920
push 4
lea eax, [esp + 4]
push eax
push 4
push 0
push ebx
mov edx, dword [esp + 0x18]
push edx
call sub.ADVAPI32.DLL_RegSetValueExA
test eax, eax
jne 0x40c916
mov ecx, dword [esp + 4]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x40c920
mov eax, dword [esp + 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x408
pop edi
pop esi
pop ebx
ret