joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b893
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x446228]
and dword [ebp - 8], 0
mov dword [ebp - 4], edi
mov ecx, dword [esi + 0x6c]
mov dword [eax + 0x6c], ecx
test dl, dl
je 0x41b89e
push edi
mov dword [ebp - 4], edi
jne 0x41b8a2
lea ecx, [ebp - 0x1014]
push ecx
mov esi, eax
pop ecx
cmp esi, eax
je 0x41b8d3
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
add esp, 0x10
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x41c06a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44630c
mov eax, dword fs:[0]
push eax
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esi + 0x14]
push ecx
mov esi, dword [eax + 4]
lea edi, [esi + 4]
mov eax, dword [edi]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jl 0x41c08f
jle 0x41c07c
cmp ebx, dword [edi]
jl 0x41c096
push ebx
push esi
mov esi, ecx
mov byte [ebp - 0x44], bl
mov byte [ebp - 0x22], bl
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0x44620c
mov ecx, dword [esi + 0x20]
lea edx, [esi + 0x28]
push edx
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
pop ebp
jmp 0x41c0be

Function at 0x41e440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
inc ecx
mov ecx, dword [ebp - 0xc]
and ecx, 0xff
cmp ecx, 0x6e
jne 0x41e447
cmp dword [ebp - 0x244], 1
jne 0x41e446
mov ecx, dword [ebp - 8]
mov edx, dword [esi + 4]
mov eax, dword [esi]
push edx
push esi
mov eax, dword [0x446240]
xor eax, ebp
push eax
mov eax, dword [edx + 0x2c]
mov ecx, esi
mov ebx, dword [edx]
mov dword [ebp + 0x14], ebx
mov ebx, dword [ebp - 4]
push edi
push dword [eax + 0x1c]
push 0xffffffffffffffff
push 0x44610c
mov eax, dword fs:[0]
push eax
push ebx
cmp esi, dword [edi]
jl 0x41e482
mov byte [edi + 0x1c], 1
mov byte [esi + 0x1c], 0
mov esi, dword [esi + 0x10]
lea eax, [ebp - 0x14]
push eax
call esi
push 0x446374
push 0x446018
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040529f
pop ecx
cmp edi, ebx
jne 0x41e4b4
mov esi, dword [ebp - 0xc]
mov byte [eax + 0xa], bl
shr edi, 0x18
mov bl, byte [edi + 0x446218]
mov byte [eax], bl
jmp 0x41e4b4

Function at 0x41eda9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
lea ecx, [ebp - 0x3c]
push ecx
mov cl, byte [edi + 2]
mov edx, eax
cmp eax, 0xffffffff
jne 0x41eddd
cmp edx, dword [ebx + 4]
jne 0x41edb0
mov al, byte [ebp - 0xa]
cmp al, 0x5f
jne 0x41edec
mov edi, dword [ecx + 0x34]
and edi, 0xf0000000
shl edx, 0x10
add dword [ebp - 0x18], 0xfff0
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x1bc]
mov edx, dword [ebp - 0x1b8]
add eax, 4
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push eax
sub esp, 0x48
mov eax, dword [0x4462dc]
xor dword [ebp - 4], eax
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp + 0xc], ecx
je 0x41edf9
mov eax, dword [ebp - 0x28]
pop ecx
push eax
push 1
mov dword [0x446014], eax
mov dword [0x446380], 0x446308
pop eax
cmp ecx, eax
jle 0x41ee17
pop ebx
pop ebp
ret 4
Function at 0x42047e
Capabilities:
Encode data using xor
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push edi
push esi
push 8
call dword [sym.imp.USER32.dll_GetMenu]
mov edx, dword [ebp + 0xc]
xor ecx, ecx
cmp eax, ecx
jb 0x4204a2
cmp dword [ebp - 4], 0
jg 0x42048e
cmp ecx, 0xffffffff
je 0x420491
cmp esi, edx
jae 0x42048e
mov edx, dword [esi + 0x10]
push 4
jmp 0x4204d3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
and dword [esi + 0x24], 0xffffffbf
cmp dword [ebx + 0x50], 0
jne 0x4204b8
mov esi, dword [ebp - 8]
mov esi, dword [esi + edx*4]
cmp esi, 0x18
ja 0x4204c2
mov eax, dword [edi]
mov edx, dword [edi + 4]
xor edx, dword [ebx + 4]
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call edx
add esp, 0xc
test eax, eax
jne 0x4204da
jmp 0x420502
mov edi, 0x4462e8
push esi
mov ecx, edi
sub ecx, eax
add esi, 0xfffffffe
add ecx, 0x30
cmp edi, esi
je 0x420508
push ebx
xor ebx, ebx
push ebx
call fcn.0040a302
mov ecx, dword [edi + 8]
mov ebx, eax
lea esi, [ebx + 1]
push esi
push ecx
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x10], 0
mov dword [ebp + 8], eax
jns 0x420528
mov eax, dword [esi]
call dword [eax + 0x8c]
push 0xffffffffffffffff
push 0x446078
mov eax, dword fs:[0]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 0x2c]
push 0x446020
mov ecx, esi
call fcn.004352f7
add esp, 4
mov al, 1
mov byte [ebp - 0x14], al
cmp dword [edx + 0x40], 0
je 0x420555
mov eax, dword [ebp + 8]
jmp 0x420567
Function at 0x422c12
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x446078]
xor eax, ebp
push eax
push ecx
push ebx
call dword [eax + 0x4462d0]
mov eax, dword [ebx]
test byte [esi + eax + 4], 4
jne 0x422c1d
and dword [ebp - 0xe], 0
cmp dword [ebp - 0xa], 0xffffffff
je 0x422c41
push 1
sar ecx, 1
add edi, ecx
movzx ebx, word [ebx + edi*2]
add ecx, 0x10
mov ecx, dword [ecx]
mov dword [edi], ecx
jmp 0x422c67
mov dword [ebp - 0x20], eax
and byte [ebp - 8], 0
cmp byte [ebp - 5], 0
jne 0x422c94
mov ecx, dword [edi + 0x54]
push ecx
push eax
push 0
lea eax, [ebp - 0x314]
push dword [0x4463d8]
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
cmp eax, 1
jne 0x422c81
xor ecx, ecx
cmp ah, al
jne 0x422c92
and dword [ebp - 0x22], 0
cmp dword [ebp - 0x1e], 0xffffffff
jne 0x422c7b
add esi, 8
cmp eax, 8
mov dword [ebp - 0x80], eax
jge 0x422c98
xor esi, esi
jmp 0x422c92

Function at 0x423473
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4462b0
mov eax, dword fs:[0]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov byte [ebp - 0x37], 0
mov dword [ebp - 0xcc], 0x446320
lea edx, [ebp - 0xcc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
test eax, eax
je 0x4234c4
test al, 8
je 0x4234bf
cmp eax, 3
jle 0x423498
mov eax, dword [ebp + 0x14]
inc dword [0x446158]
or dword [ebp - 0x1c], 0xffffffff
xor edi, edi
mov dword [ebp - 0x24], edi
test al, al
je 0x4234d4
cmp dword [ebp + 0x10], 1
je 0x4234e5
push edi
mov ecx, esi
push dword [ebp + 8]
call fcn.00442bc7
add esp, 0x10
mov eax, dword [ebp - 8]
lea ecx, [ecx + edx + 1]
mov dword [edi], eax
add eax, 0x40
add ebx, 2
add esi, 4
mov ebx, edx
and bl, 0xc0
cmp bl, 0x80
je 0x42350b
cmp dword [ebp + 8], 7
jae 0x423511
mov edx, dword [ebp - 0x32]
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x28]
sub eax, ecx
sar eax, 1
push ebx
push 0x44610c
push 0x446390
call fcn.00428938
mov edx, dword [ebp - 0xf4]
push edx
call fcn.0041b8d8
or dword [ebp - 4], 0xffffffff
push ebx
push esi
mov eax, dword [0x44635c]
xor eax, esp
push eax
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
push eax
lea eax, [ebp + 8]
push eax
call esi
push 0x446178
lea edx, [esp + 0x74]
push 0x446238
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [ebp - 0x210]
push eax
call ebx
add esp, 4
cmp eax, 0xd
jne 0x423564
mov edx, dword [ebp - 8]
mov edi, 0x4461a4
mov ecx, dword [esi]
push 0
call fcn.0043938b
pop ecx
jge 0x4235af
cmp eax, 0xc00000b0
je 0x423580
push 0x2000
lea eax, [ebp - 0x2304]
push 0
push edi
mov edi, dword [ecx]
and edx, dword [ebp - 8]
and edi, esi
or ecx, edi
jne 0x4235af
xor edx, edx
sub ecx, esi
xor edx, edx
mov eax, ebx
and eax, 0x2000
neg eax
pop esi
pop edi
lea eax, [ecx + eax*4]
test eax, eax
jg 0x4235be
cmp ecx, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov edi, dword [ebx + 0xc]
mov edx, edi
pop edi
lea eax, [edx + 0x104]
pop esi
pop ebx
add esp, 0x128
ret 4
Function at 0x427f23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446144
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x446120]
xor dword [ebp - 4], eax
xor eax, ebp
mov dword [ebp - 0x14], eax
jb 0x427f3f
mov edx, dword [ecx + 4]
sub esp, 0x1c
push ebx
mov ecx, edi
call fcn.0043ef0e
add esp, 8
mov edi, eax
mov dword [ebp - 0x1014], edi
mov dword [ebp - 0x1010], edx
test edx, edx
je 0x427f50
cmp dword [esi + 0x28], 0
je 0x427f58
push eax
push ebx
push dword [ebp - 8]
push esi
xor esi, esi
lea eax, [ebp - 8]
push eax
call fcn.0042217b
add esp, 0xc
jmp 0x427f75

Function at 0x42c08a
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], bl
mov eax, dword [0x44630c]
mov esi, eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42c08d
mov eax, dword [ebp - 0xf0]
cmp byte [eax + 8], 0
je 0x42c0cc
add edx, 0x25
mov eax, dword [ebp - 0x630]
add edx, 0x25
push edx
call fcn.00440cee
mov edx, dword [ebp - 0x1c]
push edx
push 0x446160
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push esi
push 0
push 0x4461e0
mov edx, dword [ebp - 0x34]
sub edi, dword [ebp - 0x24]
shl eax, 0xd
add edx, 0xfffffe00
or eax, edx
jne 0x42c0db
push dword [esp + 4]
push dword [ecx + 0x1c]
mov eax, dword [esi]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
pop edi
or eax, 1
mov dword [ebp - 0x570], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x34]
call fcn.0043b543
push 0x446334
or esi, 0xf
push 0x4462ac
lea eax, [ebp - 0x78]
push eax
call fcn.0042b587
mov eax, ebx
call fcn.004418e6
mov ecx, dword [ebp - 0xc4]
mov dword [ecx + 0x54], eax
mov edx, dword [0x446240]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ecx
mov edx, dword [edi + 4]
cmp edx, ebx
je 0x42c164
cmp dword [esi + 0x50], 0
je 0x42c14e
mov ecx, dword [eax + 0x34]
and ecx, 0xf1000000
or ecx, 0x1000000
mov dword [eax + 0x34], ecx
mov eax, dword [ebp + 8]
pop ebx
pop edi
pop esi
pop ebx
ret
Function at 0x42ed60
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446194
mov eax, dword fs:[0]
mov dword [ebp - 8], eax
je 0x42ed88
push 0x446228
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov dword fs:[0], esp
sub esp, 8
lea edx, [eax + 2]
lea esp, [esp]
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc esi
lea ecx, [ebp - 0x308]
lea eax, [ebp - 0x8e4]
lea ecx, [ecx]
mov ah, byte [esi]
or ah, ah
jne 0x42ed97
mov edi, edi
mov al, byte [esi]
xor edx, edx
mov dl, byte [ecx]
movzx edi, dl
mov bl, byte [edi + 0x446148]
mov byte [eax + 3], bl
mov esi, edi
cmp esi, ebp
jb 0x42edb5
test eax, eax
jl 0x42edc1
dec ecx
je 0x42edb5
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x42edcb
mov al, byte [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
lea edx, [ecx + eax + 6]
mov dword [ebp - 0x9c], edx
cmp dword [ebp - 0x9c], 0xffffffff
je 0x42edd6
cmp bl, 7
je 0x42eddd
push dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x48]
call fcn.0041bc59
push 0x44634c
lea edx, [ebp - 0x510]
mov eax, 0xe001018e
pop ebp
ret

Function at 0x4352f7
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jge 0x4352fa
add al, 0x30
mov byte [esi], al
mov dword [edi], ebx
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
sete dl
mov byte [ebp - 0x14], dl
lea ecx, [eax + 0x3c]
mov dword [ebp - 0x14], ecx
mov dword [ecx], ebx
mov ebx, dword [ebp - 0x18]
mov edx, eax
shr edx, 8
mov byte [ebp - 0x18], dl
mov byte [ebp - 0x17], al
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x4c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + eax + 0x30]
push edx
mov edx, dword [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop ebp
ret 8
Function at 0x437106
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0xffffff
lea edx, [ebp - 0x348]
push edx
mov edx, dword [ebp + 0xc]
mov byte [ecx + 0x24], 4
mov dword [edx], 0xc
mov eax, dword [ebp + 8]
cmp eax, 0x41
jl 0x43710a
lea eax, [ebp - 0xe8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebp - 0x1c], eax
push dword [0x4463b0]
call esi
add esp, 0x14
cmp byte [ebp - 8], 0
jne 0x43713c
test ebx, ebx
jge 0x43713c
add byte [esi + 1], al
test byte [0x44638c], 1
je 0x437145
mov edx, dword [0x44621c]
movzx ecx, cl
test byte [edx + ecx*2 + 1], 0x80
je 0x437183
lea ebx, [ecx + 0x18]
lea edx, [eax + 0x14]
test bl, bl
jne 0x437177
mov eax, dword [esi + 8]
add ecx, edi
mov dword [esi + 4], edi
mov dword [esi + 8], ebx
pop edi
pop esi
jmp 0x4371b0
mov dword [ebp - 4], 1
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
jle 0x4371a9
mov edi, eax
pop ecx
mov dword [ebp - 0x20], eax
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_DestroyMenu]
mov dword [ebp - 0x14], esi
lea ebx, [eax + 8]
test ebx, ebx
jne 0x4371be
shr edi, 1
sub dword [ebp - 0x1014], edi
sbb dword [ebp - 0x1010], 0
cmp byte [ebp - 0x1005], 1
je 0x4371ce
mov edx, dword [edi]
mov edx, dword [edx + 0x14]
lea eax, [ebp - 0x964]
push eax
mov ecx, dword [0x4462d0]
push ecx
mov ecx, esi
call fcn.004370f2
mov byte [esp + 0x38], 1
lea ecx, [edi + 8]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esi + 0x24]
mov dword [esi + 0x28], edx
mov eax, dword [ebx + 0x14]
cmp byte [ebx + 0x18], 0
jne 0x43721b
mov eax, dword [ebp - 0x118]
push eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.USER32.dll_GetKeyState]
lea ecx, [ebp - 0xa4]
call fcn.0043a3cf
mov dword [ebp - 4], esi
jmp 0x43723d
Function at 0x437351
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4460bc
mov eax, dword fs:[0]
push eax
push 0
push 1
xor edx, edx
mov word [eax + 0x14], dx
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x84]
jmp 0x437387
mov ecx, dword [esi + 0x98]
push edi
push ebx
mov ebx, dword [0x4461e8]
push esi
mov esi, dword [ebp + 0xc]
test edx, edx
je 0x43738e
mov ecx, dword [edi + 0x14]
sub ecx, dword [ebp - 8]
lea eax, [ebx - 0x3040]
cmp eax, 0xa763
ja 0x4373bf
add bl, 0x30
dec esi
mov dword [ebp - 0x18], esi
je 0x4373b0
lea eax, [ebx + ebx*2]
shl eax, 4
mov dword [edi + ecx + 0x18], eax
mov eax, dword [esi + 0x3c]
cmp dword [eax + 0x38], 0
jne 0x4373b4
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov edx, dword [ebp - 0x4c]
mov dword [edi + 8], edx
cmp eax, 0x10ffff
jbe 0x4373d6
cmp eax, dword [ebp - 8]
je 0x437407
test byte [ebp - 0x24], 1
je 0x437405
cmp al, 0xc
jne 0x4373dc
push 0x4463ac
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov edi, eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4463c0
or eax, 0xffffffff
mov dword [ebp - 4], eax
mov dword [esi + 8], eax
pop esi
pop ecx
mov dword [0x44627c], eax
pop ecx
je 0x437439
mov dword [esi], eax
mov edi, dword [ebx + 8]
test edi, edi
je 0x437425
jmp 0x437440
push 9
push dword [ebp + 0x20]
mov esi, eax
push 2
push 4
lea eax, [ebp - 4]
xor esi, esi
cmp dword [ebp - 0xa4], esi
jne 0x437437
add dword [esi + 0x218], 1
movzx eax, word [edi + ecx*2]
jmp 0x437447

Function at 0x43baa3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x446068]
mov dword [ebp - 0x328], eax
mov eax, dword [0x44601c]
mov dword [ebp - 0x324], eax
call dword [sym.imp.USER32.dll_GetKeyState]
push 0
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x24]
push esi
push dword [esp + 8]
mov esi, ecx
mov eax, dword [esi + 0x68]
mov dword [edi + 0xc], eax
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
jne 0x43bad1
mov eax, 0x7fffffff
jmp 0x43bad1

Function at 0x43f934
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push eax
mov eax, dword [esi + 4]
jmp 0x43f94d
lea ebx, [ebp - 0x28]
call fcn.00412df8
cmp edi, eax
jbe 0x43f93b
mov eax, ecx
pop esi
pop ebx
pop ecx
test ebx, ebx
jg 0x43f975
je 0x43f945
movzx eax, word [edi]
mov edx, dword [edx]
call edx
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0xc], ecx
test bl, bl
jne 0x43f969
mov dword [edi], 0
mov eax, dword [edi + 0x10]
mov edx, dword [edi + 0xc]
mov dword [eax], edx
jne 0x43f98c
cmp dword [ebp - 8], esi
jbe 0x43f994
mov edx, ecx
sub edx, dword [eax + 8]
sub edx, 2
neg edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
mov esi, 0x4461c4
push esi
call ebx
test eax, eax
je 0x43f98f
push ebx
push eax
movzx eax, word [0x4462c0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov ecx, 0x44622c
mov edx, 0x4463d4
jmp 0x43f9ab
Function at 0x43ff91
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fc
mov eax, dword [0x4460fc]
xor eax, ebp
push eax
push esi
push edi
push esi
mov dword [ebp - 0x1c], ecx
mov eax, dword [ecx]
cmp eax, edx
xor edx, ecx
cmp eax, edx
jl 0x43ffa4
cdq
idiv edi
add byte [esi + 3], al
mov eax, edx
sub eax, dword [ebx + 8]
cmp dword [ecx], 0
jg 0x43ffcf
xor ecx, ecx
cmp dword [eax + 0x3c], edi
setne cl
push ecx
push 0x44600c
lea eax, [ebp - 4]
push eax
lea ecx, [edi - 0xc]
call fcn.0042d80f
test eax, eax
je 0x440004
mov ebx, eax
mov esi, edi
shl esi, 2
mov eax, dword [esi + 0x446098]
jmp 0x43ffe8
dec eax
js 0x43ffe6
cmp eax, dword [0x446114]
jb 0x43ffeb
mov ecx, 0xff10
mov edx, ecx
cmp ax, dx
je 0x440014
add eax, 0x48
mov eax, dword [eax]
mov edi, dword [esi + 0x64]
cmp eax, 0xc000008e
jne 0x44003a
inc dword [0x446020]
or dword [ebp - 4], 0xffffffff
jmp 0x440054
mov eax, dword [ebp + 8]
push ebx
push 0
call fcn.00427e51
push 0x22
jmp 0x440036
mov ecx, dword [0x4461c4]
cmp ecx, eax
jbe 0x440039
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0xac], 1
jle 0x44004a
cmp byte [ebp - 1], bl
jle 0x440081
cmp edx, dword [ebp - 0x24]
jae 0x440054
or ecx, 0xdc00
mov word [eax + 0x74], cx
mov byte [eax + 0x41], 1
mov dword [ecx], 0xf
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
push ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 8], ecx
xor eax, eax
cmp dword [esp + 0x14], ebp
pop edi
lea eax, [edx + 0x104]
pop esi
push eax
mov eax, dword [edi]
push dword [ebp + 0xc]
push 1
push eax
mov ecx, edi
call fcn.0042312e
jmp 0x44009c
Function at 0xbea058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00bea1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xbea07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbea06a
add dl, dl
jne 0xbea089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbea0dc
xor eax, eax
add dl, dl
jne 0xbea096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbea17d
add dl, dl
jne 0xbea0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbea0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbea0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbea0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xbea0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xbea075
mov eax, 1
add dl, dl
jne 0xbea0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbea0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbea0e1
sub eax, ebx
mov ebx, 1
jne 0xbea128
mov ecx, 1
add dl, dl
jne 0xbea10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbea119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbea105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbea075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xbea13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbea14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbea136
cmp eax, 0x7d00
jae 0xbea16d
cmp eax, 0x500
jb 0xbea168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbea075
cmp eax, 0x7f
ja 0xbea170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbea075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xbea19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xbea075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x81afd3
Capabilities:
Packed with generic packer

Disassembly:
push edx
mov edx, 0x64
jmp 0x81aff6
mov ecx, 0x1000
jmp 0x81afe7
add eax, ecx
add eax, ebx
dec ecx
or ecx, ecx
jne 0x81afe2
push edx
push esp
push esp
call dword [sym.imp.kernel32.dll_lstrcpy]
pop edx
dec edx
or edx, edx
jne 0x81afdb
pop edx
jmp section..data_2
Function at 0x5330b8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, edx
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [0x556728]
mov eax, dword [eax]
call fcn.0047adb0
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, esi
cdq
cmp edx, dword [esp + 4]
jne 0x5330f9
cmp eax, dword [esp]
pop edx
pop eax
jae 0x5330c3
pop esi
pop ebx
ret
pop edx
pop eax
jge 0x5330c3
pop esi
pop ebx
ret

Function at 0x5424a8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, eax
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [0x556728]
mov eax, dword [eax]
call fcn.0047adb0
sub ebx, esi
cmp edi, ebx
ja 0x5424b4
pop edi
pop esi
pop ebx
ret

Function at 0x548cf8
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004051e4
xor eax, eax
push ebp
push 0x548dae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404d34
lea eax, [ebp - 0x19c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor eax, eax
push ebp
push 0x548d8e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004051f4
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x548d84
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], eax
xor ebx, ebx
jmp 0x548d7a
push dword [esi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, edi
call fcn.00404f2c
inc ebx
mov eax, dword [ebp - 0xc]
mov esi, dword [eax + ebx*4]
test esi, esi
jne 0x548d69
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x548d98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x548db5
lea eax, [ebp - 4]
call fcn.00404d34
ret
Function at 0xea6142
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 1], cl
stc
jbe 0xea61d3
ja 0xea617d
invalid
pushfd
pop ds
inc edi
inc esi
call fcn.00ea6142
ror esi, 0
neg dl
je 0xea619c
and eax, 0x10909691
jmp 0xea6186
adc bl, ch
adc eax, 0xe3841683
push ds
scasb al, byte es:[edi]
pop es
scasb al, byte es:[edi]
mov ecx, 0x86d2fb98
shl byte [esi - 9], 1
sal dh, cl
aad 0xeb
push esp
xchg al, dl
not dx
not ch
jmp 0xea61da
rdtsc
bsf dx, bp
not edx
jmp 0xea61b3
and eax, 0x10909691
rdtsc
bsf dx, bp
not edx
btc cx, bx
jmp 0xea622d
btc cx, bx
jmp 0xea622d
mov ebx, 0xc174ebd9
into
add al, ch
xor al, byte [eax]
add byte [eax], al
ror esi, 0
call 0xea61f3
cmpsd dword [esi], dword es:[edi]
cmp al, 0xd2
mov ch, 0x44
not dword [ebx + reloc.MSVCRT.dll_strncpy]
mov esi, 0x1de24b28
insb byte es:[edi], dx
jg 0xea615a
xchg al, dl
not dx
not ch
shl byte [esi - 9], 1
sal dh, cl
aad 0xeb
xchg dword [esi + 0xf], esp
mov esp, 0x782a79c7
sub byte [ebp - 0x3c], bl
pop edx
cmp eax, 0x71ed78cc
loope 0xea616e
jmp 0xea6163
jae 0xea61b5
ljmp 0x7ec:0x83e6eb57
bt dx, dx
btc ax, si
jno 0xea61b9
jo 0xea61b9
mov ecx, esi
jmp 0xea6267
movzx edx, byte [ecx]
lea ecx, [ecx + ebx]
bswap eax
xchg ecx, eax
mov ax, 0x6fd7
jmp fcn.00ea6295
add ecx, reloc.MSVCRT.dll_strncpy
jl 0xea6251
movzx edx, byte [ecx]
jmp 0xea62d9
lea ecx, [ecx + ebx]

Function at 0xeadc52
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0xe944ab
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0xe944c5
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0xe944b4
pop esi
jmp 0xe944d0
ret 4
lea esp, [esp + 4]
jmp 0xe9449e