joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4da920
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 0x10], edi
mov edx, dword [ebx + 0x13c]
test edx, edx
mov ecx, edx
mov eax, dword [ebx + 0x38]
mov edi, dword [ebx + 0x40]
jne 0x4da945
mov ecx, 0x20000
sub edi, eax
cmp edi, ecx
ja 0x4da973
push 0
lea edx, [ebp - 8]
push edx
push edi
push eax
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 0xffffffff
test eax, eax
je 0x4da9e8
mov ecx, 1
jmp 0x4da9e8
test edx, edx
mov ecx, edi
mov dword [ebp - 0x18], edi
mov edi, eax
jne 0x4da983
mov edx, 0x20000
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], esi
mov esi, ecx
push 0
lea edx, [ebp - 8]
push edx
push dword [ebp - 4]
push edi
push dword [ebx + 0xe4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4da9b2
mov edi, dword [ebp - 0x18]
mov ecx, 0xffffffff
mov esi, dword [ebp - 0x14]
jmp 0x4da9e8
mov edx, dword [ebx + 0x13c]
test edx, edx
mov eax, dword [ebp - 8]
jne 0x4da9c4
mov edx, 0x20000
sub esi, eax
add edi, eax
cmp esi, edx
jae 0x4da9d5
mov dword [ebp - 4], esi
test esi, esi
jne 0x4da9d9
jmp 0x4da9dd
test esi, esi
je 0x4da9dd
test eax, eax
ja 0x4da98b
mov edi, dword [ebp - 0x18]
mov ecx, 1
mov esi, dword [ebp - 0x14]
mov edx, dword [ebx + 0x38]
mov eax, dword [ebx + 0xf8]
mov dword [ebx + 0x40], edx
add edx, eax
xor eax, eax
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], eax
mov eax, edi
mov dword [ebx + 0x44], edx
cdq
mov eax, dword [ebx + 0xc0]
add edi, eax
mov dword [ebx + 0xc0], edi
adc edx, dword [ebx + 0xc4]
and byte [ebx + 0x16d], 0xfb
mov dword [ebx + 0xc4], edx
cmp ecx, 0xffffffff
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xbc], edx
je 0x4daa48
xor eax, eax
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0xe8], eax
mov eax, 0x26
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4f76e0
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x4fa6d0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x7c]
test esi, esi
mov dword [ebp - 0xc], edi
je 0x4fa88c
mov edx, dword [0x577aa0]
mov edi, dword [esi + 0x14]
lea eax, [edi*4]
shl edi, 5
sub edi, eax
cmp edx, 2
lea ebx, [edi + 0x581568]
jge 0x4fa71f
mov eax, dword [ebx]
test eax, eax
jne 0x4fa760
mov dword [edi + 0x581568], 1
jmp 0x4fa760
push ebx
call fcn.004d87b0
add esp, 4
test eax, eax
jne 0x4fa75a
cmp dword [edi + 0x581564], 0
je 0x4fa86c
mov dword [edi + 0x581568], 0
push 0xffffffffffffffff
push dword [edi + 0x581564]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call fcn.004d87b0
add esp, 4
mov edx, dword [0x577aa0]
cmp edx, 1
je 0x4fa858
mov eax, dword [esi + 0x18]
dec eax
mov dword [esi + 0x18], eax
test eax, eax
jle 0x4fa7cf
mov eax, dword [0x577aa0]
cmp eax, 1
je 0x4fa7b4
cmp eax, 2
jge 0x4fa78f
mov dword [edi + 0x581568], 0
jmp 0x4fa7a5
mov dword [edi + 0x581568], 0
push dword [edi + 0x581564]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
push dword [edi + 0x581578]
push dword [edi + 0x581574]
call fcn.004d8790
add esp, 8
mov eax, dword [0x577aa0]
jmp 0x4fa77e
mov edx, dword [esi]
test edx, edx
je 0x4fa7db
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x4fa7e6
mov dword [eax], edx
jmp 0x4fa7ec
mov dword [edi + 0x581560], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x7c], 0
mov eax, dword [0x577aa0]
cmp eax, 1
je 0x4fa83d
cmp eax, 2
jge 0x4fa811
mov dword [edi + 0x581568], 0
jmp 0x4fa827
mov dword [edi + 0x581568], 0
push dword [edi + 0x581564]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 8]
call fcn.004f1e90
push esi
call fcn.004f1e90
add esp, 8
jmp 0x4fa7a5
push dword [edi + 0x581578]
push dword [edi + 0x581574]
call fcn.004d8790
add esp, 8
mov eax, dword [0x577aa0]
jmp 0x4fa800
lea eax, [edi + 0x581574]
push eax
call fcn.004d8760
add esp, 4
jmp 0x4fa769
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi + 0x581564], eax
mov dword [edi + 0x581568], 0
jmp 0x4fa743
xor eax, eax
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4fe290
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x5017f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
movzx ecx, byte [edx + 0x16d]
and ecx, 0x20
shr ecx, 5
mov ebx, dword [eax]
test ecx, ecx
mov eax, dword [eax + 8]
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
je 0x501869
cmp eax, 5
jl 0x501869
cmp eax, 0x11
jg 0x501869
mov edx, dword [ebp + 0x10]
mov eax, edx
shr eax, 0x1f
add eax, edx
sar eax, 1
test eax, eax
jle 0x50185a
mov edx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x1c], eax
xor ecx, ecx
lea edi, [edx + ebx]
movzx eax, byte [ebx]
inc esi
movzx edx, byte [ecx + edi - 1]
xor eax, edx
mov byte [ebx], dl
inc ebx
xor byte [ecx + edi - 1], al
dec ecx
cmp esi, dword [ebp - 0x1c]
jl 0x501842
xor eax, eax
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
movsx edi, byte [edx + 0x158]
cmp eax, 0x19
jl 0x50185a
cmp eax, 0x1f
jle 0x501890
cmp eax, 0x32
jl 0x501886
cmp eax, 0x34
jle 0x501890
jmp 0x50185a
cmp eax, 0x28
jl 0x50185a
cmp eax, 0x30
jg 0x50185a
test ecx, ecx
je 0x5018f3
test edi, edi
je 0x5018a2
cmp eax, 0x34
je 0x5018a2
cmp eax, 0x32
jne 0x5018f3
mov edx, dword [ebp + 0x10]
mov esi, edx
shr esi, 0x1f
add esi, edx
sar esi, 1
test esi, esi
jle 0x5018f3
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
lea ecx, [eax + ebx]
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov esi, dword [ebp - 0x14]
mov eax, ebx
movzx edi, byte [eax]
inc edx
movzx ebx, byte [ecx + esi - 1]
xor edi, ebx
mov byte [eax], bl
inc eax
mov ebx, edi
xor byte [ecx + esi - 1], bl
dec ecx
cmp edx, dword [ebp - 0x10]
jl 0x5018cd
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
mov edx, dword [eax*4 + 0x566fdc]
cmp edx, 0xffffffff
je 0x501988
lea eax, [edx*4]
shl edx, 5
sub edx, eax
mov edx, dword [edx + edi*4 + 0x5670c0]
test edx, edx
je 0x50185a
lea eax, [ebp - 0x1c]
push eax
push 0
push ebx
call edx
add esp, 0xc
cmp eax, 1
jne 0x501988
cmp dword [ebp + 0x10], 4
jne 0x501944
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov dword [ecx], edx
jmp 0x50185a
cmp dword [ebp + 0x10], 8
jne 0x501961
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov dword [edx], eax
mov esi, dword [ecx]
mov ebx, dword [ebp - 0x18]
mov dword [esi + 4], ebx
jmp 0x50185a
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov dword [ecx], edx
mov esi, dword [eax]
mov ebx, dword [ebp - 0x18]
mov dword [esi + 4], ebx
mov edx, dword [eax]
mov edi, dword [ebp - 0x14]
mov dword [edx + 8], edi
mov ecx, dword [eax]
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
jmp 0x50185a
mov eax, 0x5f
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x5079fc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], esi
mov esi, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ebx
mov ebx, edx
mov dword [ebp - 4], edi
mov edx, eax
mov dword [ecx], 0
cmp dword [0x587060], 0
je 0x507ad3
cmp dword [ebp + 0x20], 2
je 0x507a33
cmp dword [ebp + 0x20], 1
jne 0x507a42
mov eax, 0xffffffff
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x18], 0
je 0x507a52
cmp dword [ebp + 0x20], 0xfffffffa
je 0x507b98
cmp dword [ebp + 0x20], 0
je 0x507ba4
xor ecx, ecx
xor edi, edi
cmp dword [ebp + 0x18], 0
je 0x507a87
cmp dword [ebp + 0x1c], 0
je 0x507a87
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edx
call fcn.005504e0
push edi
call fcn.00550500
mov edx, dword [ebp - 0x10]
add esp, 8
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x507ad3
push edi
push esi
push ebx
call fcn.005504e0
add esp, 0xc
mov esi, eax
mov eax, dword [ebp + 0x14]
cmp esi, 0xffffffff
mov dword [eax], esi
je 0x507bc8
push 0
push edi
push 2
push 0x56895c
call fcn.005504e0
add esp, 0x10
mov edx, dword [ebp + 0x14]
mov eax, 1
mov byte [esi + ebx], 0xa
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
inc dword [edx]
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], edx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x24]
test ecx, ecx
mov edx, dword [ebp - 0x10]
mov dword [edi], 0
je 0x507afb
mov edi, dword [ecx + 0x13c]
test edi, edi
jne 0x507b00
mov edi, 0x20000
cmp esi, edi
jbe 0x507b74
cmp dword [ebp + 0x20], 0
je 0x507b74
test ecx, ecx
je 0x507b18
mov edi, dword [ecx + 0x13c]
test edi, edi
jne 0x507b1d
mov edi, 0x20000
mov dword [ebp - 0x10], edx
push 0
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x507b62
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
add ebx, edx
sub esi, edx
add dword [ecx], edx
cmp dword [ebp + 0x24], 0
je 0x507b57
mov edx, dword [ebp + 0x24]
mov edx, dword [edx + 0x13c]
test edx, edx
jne 0x507b5c
mov edx, 0x20000
cmp esi, edx
ja 0x507b62
mov edi, esi
test esi, esi
je 0x507b8b
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x18]
jne 0x507b8b
test eax, eax
jne 0x507b20
jmp 0x507b8b
push 0
lea ecx, [ebp - 0x18]
push ecx
push esi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edi, edx
mov ecx, 1
jmp 0x507a66
mov dword [ebp - 0x10], edx
call fcn.00550500
mov edx, dword [ebp - 0x10]
mov edi, eax
cmp dword [0x587060], 0
je 0x507a8b
mov ecx, 1
jmp 0x507a60
xor eax, eax
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x529190
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
cmp dword [0x5791d0], 0
je 0x52921c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x34]
push edx
push ecx
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x529212
fld qword [0x56bda8]
fild qword [esp + 0x3c]
fdiv st(1)
fst qword [0x585bb0]
fild qword [esp + 0x34]
fdivrp st(2)
mov eax, dword [ebp + 8]
fxch st(1)
fst qword [0x585bb8]
fld qword [0x585ba8]
mov dword [0x5791d0], 0
fsubrp st(1)
fchs
fst dword [eax + 4]
fxch st(1)
fsub qword [0x585ba0]
fst dword [eax]
fxch st(1)
jmp 0x5292ea
fld dword [0x56bdd8]
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5791cc]
lea edx, [esp]
mov dword [esp], 0xffffffff
xchg dword [edx], eax
mov eax, dword [esp]
cmp eax, 0xffffffff
jne 0x529251
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x1c]
mov edx, 0x5791cc
mov dword [esp], eax
xchg dword [edx], eax
mov eax, dword [esp]
cmp eax, 1
jg 0x5292a9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x34]
push edx
push ecx
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x52929f
fld qword [0x56bda8]
fild qword [esp + 0x3c]
fdiv st(1)
fst qword [0x585ba0]
fild qword [esp + 0x34]
fdivrp st(2)
fxch st(1)
fst qword [0x585ba8]
fxch st(1)
jmp 0x5292c8
fld dword [0x56bdd8]
mov esp, ebp
pop ebp
ret
call fcn.0052d4ca
mov dword [esp], eax
fldz
fst qword [0x585ba8]
fild dword [esp]
fdiv qword [0x56bdb0]
fst qword [0x585ba0]
mov eax, dword [ebp + 8]
mov dword [0x5791d0], 1
fsubr qword [0x585bb0]
fchs
fst dword [eax]
fxch st(1)
fsub qword [0x585bb8]
fst dword [eax + 4]
faddp st(1)
mov esp, ebp
pop ebp
ret

Function at 0x532b26
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x579f00]
jne 0x532b30
repz ret
jmp fcn.0053825d
Function at 0x534848
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x579f00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0052eb09
and dword [ebp - 0x14], 0
cmp dword [0x58652c], 0
mov dword [ebp - 0x18], eax
jne 0x5348fb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x5349a3
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x5349a3
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x58652c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x586530], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x586534], eax
call edi
push eax
call esi
mov dword [0x58653c], eax
test eax, eax
je 0x5348fb
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x586538], eax
mov eax, dword [0x586538]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x534954
cmp dword [0x58653c], ecx
je 0x534954
push eax
call esi
push dword [0x58653c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x534954
test ebx, ebx
je 0x534954
call edi
test eax, eax
je 0x53494b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x53494b
test byte [ebp - 8], 1
jne 0x534954
or dword [ebp + 0x10], 0x200000
jmp 0x534987
mov eax, dword [0x586530]
cmp eax, dword [ebp - 0x18]
je 0x534987
push eax
call esi
test eax, eax
je 0x534987
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x534987
mov eax, dword [0x586534]
cmp eax, dword [ebp - 0x18]
je 0x534987
push eax
call esi
test eax, eax
je 0x534987
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x58652c]
call esi
test eax, eax
je 0x5349a3
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x5349a5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00532b26
leave
ret
Function at 0x5f38f4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5f390f
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x124b8b34]
pop edx
test eax, eax
je 0x5f39e1
cmp dword [ebp - 0x2ac], 0x1000
jne 0x5f39d0
test dword [ebp - 0x2a8], 1
jne 0x5f39d0
and dword [ebp - 0x2a8], 0x100
jne 0x5f39d0
push esi
push edx
push 4
push esi
call dword [edx + 0x122d3b3c]
pop edx
pop esi
test eax, eax
je 0x5f3973
jmp 0x5f39d0
cmp word [esi], 0x5a4d
jne 0x5f39d0
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x5f39d0
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x122d3b24]
pop edx
test eax, eax
je 0x5f39d0
lea eax, [ebp - 0x28c]
push eax
call fcn.005f3850
test eax, eax
jne 0x5f39c9
jmp 0x5f39d0
mov eax, esi
jmp 0x5f39e1
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x5f390f
pop esi
leave
ret 4
Function at 0x77d140
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2a8000]
push edi
jmp 0x77d15a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x77d161
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x77d150
mov eax, 1
add ebx, ebx
jne 0x77d173
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x77d184
jne 0x77d1a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x77d1a3
dec eax
add ebx, ebx
jne 0x77d190
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x77d168
add ebx, ebx
jne 0x77d19f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x77d1f5
xor ecx, ecx
sub eax, 3
jb 0x77d1bb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x77d22a
sar eax, 1
mov ebp, eax
jmp 0x77d1c6
add ebx, ebx
jne 0x77d1c6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x77d194
inc ecx
add ebx, ebx
jne 0x77d1d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x77d194
add ebx, ebx
jne 0x77d1e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x77d1d6
jne 0x77d1f2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x77d1d6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x77d214
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x77d206
jmp 0x77d156
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x77d214
add edi, ecx
jmp 0x77d156
pop esi
mov edi, esi
mov ecx, 0x3bf
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x77d232
cmp byte [edi], 7
jne 0x77d232
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x77d237
lea edi, [esi + 0x37b000]
mov eax, dword [edi]
or eax, eax
je 0x77d2a6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4072c0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4072fc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x77d264
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x407304]
or eax, eax
je 0x77d2a0
mov dword [ebx], eax
add ebx, 4
jmp 0x77d281
call dword [esi + 0x407300]
mov ebp, dword [esi + 0x407308]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x257]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x77d2da
sub esp, 0xffffff80
jmp 0x40125d
Function at 0x40a3d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, ebp
or byte [ebx - 0x3f7aebc0], cl
je 0x40a410
call 0x5091b083
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40a433
push esi
stosd dword es:[edi], eax
xor eax, 0x401398
call esi
test ebx, ecx
jne 0x40a3fe
cmpsb byte [esi], byte es:[edi]
pop ebp
ret 0x7908
call esi
adc eax, 0xa7c80
pop esi
pop ebp
ret 0x63
mov eax, 0x4ea1
pop ebp
ret 8
cmp dword [0x4142dc], 0x16
jl 0x40a45f
push 0x412a30
call dword [fcn.00401b40]
mov esi, esp
or byte [eax + 0x20], ch
and byte [eax], al
push 0xf440a470
inc ecx
sub byte [ebp - 0x17afffbf], dl
insd dword es:[edi], dx
mov cl, 0xff
fidiv word [ebx]
rcr byte [ebp - 0x3d], 0x90
mov dl, byte [eax - 0x6f6ff970]
nop
nop
nop
nop
nop
nop
imul dword [eax]
pop es
inc ecx
add bh, bh
adc eax, 0x40c021
mov bh, 0xc0
cli
nop
nop
and al, 0x8b
in al, dx
mov edi, dword [ecx - 0x7eea31f8]
or al, byte [eax]
sldt eax
cmp ecx, 0xc0c50020
mov cl, byte [ecx + ebp*4]
out dx, al
add bh, bh
aas
mov eax, 2
je 0x40a4a7
xor eax, eax
pop ebp
ret
mov eax, 1
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
jmp int.00401219
Function at 0xbce370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xbce38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xbf7074
push ecx
mov edi, eax
call fcn.00be2198
mov esi, eax
add esp, 8
test esi, esi
jne 0xbce3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00be202e
push esi
call fcn.00be1fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xbd1850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xbd18ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xbfc720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xbd18ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00be21e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xbd18ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xbfc720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xbd192a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00be3082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xbd1957
mov word [eax], si
add eax, 2
push eax
call fcn.00be3030
add esp, 4
jmp 0xbd1959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xbd18ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xbd18b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xbd1ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret