joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402aec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x409014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402b84
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402b64
xor eax, eax
push ebp
push 0x402b5d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402ba0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402b64
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x409014]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x409014], ax
mov esp, ebp
pop ebp
ret

Function at 0x4031ec
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40a034], 0
je 0x40324d
cmp word [0x40a208], 0xd7b2
jne 0x403215
cmp dword [0x40a210], 0
jbe 0x403215
mov eax, 0x40a204
call dword [0x40a220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40905c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403274
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x409020], 0
jne 0x403269
push 0
push 0x409054
push 0x40905c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403e6c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403ed2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004034c0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402980
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x403ebc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403ed9
lea eax, [ebp - 0x10]
call fcn.00403370
ret

Function at 0x404a08
Capabilities:
Accept command line arguments

Disassembly:
push edi
mov edi, edx
test eax, eax
jne 0x404a36
sub esp, 0x104
mov ecx, esp
push 0x104
push ecx
push 0
call sub.kernel32.dll_GetModuleFileNameA
xchg ecx, eax
mov edx, esp
mov eax, edi
call fcn.00403460
add esp, 0x104
pop edi
ret
push eax
call sub.kernel32.dll_GetCommandLineA_1
pop ecx
inc ecx
call fcn.00407c38
mov edx, eax
call fcn.00407c48
loop 0x404a3e
mov ecx, eax
sub ecx, edx
cmp ecx, 2
jl 0x404a62
cmp byte [edx], 0x22
jne 0x404a62
cmp byte [eax - 1], 0x22
jne 0x404a62
inc edx
dec eax
sub eax, edx
xchg ecx, eax
xchg edi, eax
call fcn.00403460
pop edi
ret
Function at 0x405fd4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x406139
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov ebx, 0x10
test edi, edi
jne 0x406011
or ebx, 0x8000000
lea eax, [ebp - 0x58]
mov edx, 0x44
call fcn.004043f4
mov dword [ebp - 0x58], 0x44
mov word [ebp - 0x28], di
mov dword [ebp - 0x2c], 1
cmp dword [ebp + 8], 0
je 0x40603d
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], 0
je 0x406053
mov eax, dword [ebp - 8]
call fcn.00403624
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00403408
cmp dword [ebp - 0x14], 0
je 0x406097
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0x22
je 0x406097
mov edx, dword [ebp - 0x14]
mov eax, 0x406154
call fcn.00403670
test eax, eax
jle 0x406097
push 0x406160
push dword [ebp - 0x14]
push 0x406160
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403598
cmp dword [ebp - 0x14], 0
je 0x4060ae
test esi, esi
je 0x4060ae
lea eax, [ebp - 0x14]
mov edx, 0x406154
call fcn.004034e0
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push ebx
push 0
push 0
push 0
lea eax, [ebp - 0x6c]
mov ecx, esi
mov edx, dword [ebp - 0x14]
call fcn.00403524
mov eax, dword [ebp - 0x6c]
call fcn.00403624
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x40611b
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x406104
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle
mov byte [ebp - 9], 1
jmp 0x406112
cmp dword [ebp + 8], 0
je 0x406112
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x68]
mov dword [eax], edx
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406140
lea eax, [ebp - 0x6c]
call fcn.00403370
lea eax, [ebp - 0x14]
call fcn.00403370
ret

Function at 0x407180
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x27], 0xef
test dl, dl
je 0x40718c
or byte [eax + 0x27], 0x10
mov ecx, dword [eax + 0x1c]
jecxz 0x4071a5
push eax
je 0x4071a6
call dword [0x409100]
pop eax
push 5
push dword [eax + 0x1c]
call sub.user32.dll_ShowWindow
ret
and byte [eax + 0x37], 0xfe
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x409100]
ret
Function at 0x401000
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0
push 0
push eax
push ecx
push 0
push 0
call dword [0x407094]
ret 8

Function at 0x401390
Capabilities:
Contain obfuscated stackstrings
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov edx, ecx
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
mov bl, 0x6e
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov byte [ebp - 0x14], 0x77
and ecx, 3
mov byte [ebp - 0x12], bl
rep stosb byte es:[edi], al
mov al, 0x69
mov byte [ebp - 0x10], bl
mov byte [ebp - 0x13], al
mov byte [ebp - 0x11], al
mov al, 0x6c
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xb], al
mov byte [ebp - 0xa], al
lea eax, [ebp - 0x14]
mov byte [ebp - 0xe], 0x74
push eax
mov byte [ebp - 0xd], 0x2e
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 9], 0
call dword [0x4070a4]
mov esi, eax
test esi, esi
je 0x401528
lea ecx, [ebp - 0x24]
mov byte [ebp - 0x24], 0x49
push ecx
push esi
mov byte [ebp - 0x23], bl
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x65
mov byte [ebp - 0x20], 0x72
mov byte [ebp - 0x1f], bl
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x74
mov byte [ebp - 0x1c], 0x4f
mov byte [ebp - 0x1b], 0x70
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x18], 0x41
mov byte [ebp - 0x17], 0
call dword [0x4070a0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
push 0
push 0
push 0
push 0x4092cc
call eax
mov edi, eax
test edi, edi
mov dword [ebp - 8], edi
je 0x4014f9
mov edx, dword [ebp + 8]
push 0
push 0x4000000
push 0
push 0
push edx
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ebx, eax
test ebx, ebx
je 0x4014f2
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, edx
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 4]
dec ecx
push eax
push ecx
push edx
push ebx
call dword [sym.imp.WININET.dll_InternetReadFile]
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push esi
call dword [0x40709c]
mov esi, dword [ebp + 0xc]
push 0x4092c0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x40151f
pop edi
pop esi
mov eax, 0x4092b4
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4019c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x20
lea eax, [ebp - 0x104]
push 0x409314
push eax
call dword [0x409ccc]
add esp, 0xc
lea ecx, [ebp - 0x104]
push ecx
call dword [0x4070a4]
mov esi, eax
test esi, esi
je 0x401af9
push edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [0x4070a0]
push 0x409308
push esi
call edi
push 0x4092fc
push esi
mov dword [0x40a190], eax
call edi
test eax, eax
mov dword [0x40a194], eax
pop edi
je 0x401ae5
mov eax, dword [0x40a190]
test eax, eax
je 0x401ae5
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [0x40709c]
lea edx, [ebp - 0x104]
push edx
call dword [0x4070a8]
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402690
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, 0xfe
and eax, 0xff
push esi
cdq
idiv ecx
inc dl
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [ebp + 0xc]
test esi, esi
jbe 0x4026c7
mov eax, dword [ebp + 8]
mov cl, byte [eax]
sub cl, dl
xor cl, dl
mov byte [eax], cl
inc eax
dec esi
jne 0x4026bb
pop esi
pop ebp
ret
Function at 0x405950
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x138
push esi
mov esi, dword [esp + 0x140]
push edi
push 2
push 0
push esi
call sub.MSVCRT.dll_fseek
push esi
call sub.MSVCRT.dll_ftell
push 0
push 0
push esi
mov edi, eax
call sub.MSVCRT.dll_fseek
add esp, 0x1c
cmp edi, 0x40
jae 0x40598e
pop edi
xor al, al
pop esi
add esp, 0x138
ret
push esi
push 1
lea eax, [esp + 0x28]
push 0x40
push eax
call sub.MSVCRT.dll_fread
add esp, 0x10
cmp word [esp + 0x20], 0x5a4d
je 0x4059b4
pop edi
xor al, al
pop esi
add esp, 0x138
ret
mov eax, dword [esp + 0x5c]
lea ecx, [eax + 0x18]
cmp edi, ecx
jae 0x4059ca
pop edi
xor al, al
pop esi
add esp, 0x138
ret
push 0
push eax
push esi
call sub.MSVCRT.dll_fseek
push esi
push 1
lea edx, [esp + 0x1c]
push 0x18
push edx
call sub.MSVCRT.dll_fread
add esp, 0x1c
cmp word [esp + 0x1c], 0xe0
je 0x4059f9
pop edi
xor al, al
pop esi
add esp, 0x138
ret
push ebx
push esi
push 1
lea eax, [esp + 0x6c]
push 0xe0
push eax
call sub.MSVCRT.dll_fread
mov eax, dword [esp + 0x22]
and eax, 0xffff
lea ecx, [eax + eax*4]
shl ecx, 3
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
mov eax, dword [esp + 0x26]
and eax, 0xffff
push esi
push 1
lea edx, [eax + eax*4]
shl edx, 3
push edx
push ebx
call sub.MSVCRT.dll_fread
mov edi, dword [esp + 0x170]
mov ecx, 0x10
lea esi, [esp + 0x48]
mov eax, dword [esp + 0x17c]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x174]
mov ecx, 6
lea esi, [esp + 0x30]
add esp, 0x24
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x154]
mov ecx, 0x38
lea esi, [esp + 0x64]
rep movsd dword es:[edi], dword [esi]
mov dword [eax], ebx
pop ebx
pop edi
mov al, 1
pop esi
add esp, 0x138
ret
Function at 0x405b20
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push 0
push 0
push ebp
call sub.MSVCRT.dll_fseek
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
xor eax, eax
add esp, 0xc
mov ax, word [ecx + 6]
mov esi, dword [ebx + 0x3c]
test eax, eax
jle 0x405b5f
mov edx, dword [esp + 0x24]
add edx, 0x14
mov ecx, dword [edx]
cmp ecx, esi
jae 0x405b59
mov esi, ecx
add edx, 0x28
dec eax
jne 0x405b51
mov edi, dword [esp + 0x28]
push ebp
push esi
push 1
push edi
call sub.MSVCRT.dll_fread
add esp, 0x10
cmp eax, esi
je 0x405b7b
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x3c]
push eax
push ecx
call fcn.00405b00
mov edx, dword [esp + 0x24]
mov ebx, eax
add esp, 8
add ebx, edi
cmp word [edx + 6], 0
mov dword [esp + 0x14], 0
jbe 0x405c13
mov eax, dword [esp + 0x24]
lea edi, [eax + 8]
mov esi, dword [edi + 8]
mov eax, dword [edi]
test esi, esi
jbe 0x405be2
cmp esi, eax
jbe 0x405bb8
mov esi, eax
mov ecx, dword [edi + 0xc]
push 0
push ecx
push ebp
call sub.MSVCRT.dll_fseek
push ebp
push esi
push 1
push ebx
call sub.MSVCRT.dll_fread
add esp, 0x1c
cmp eax, esi
jne 0x405b74
mov edx, dword [esp + 0x20]
mov ecx, dword [edi]
mov eax, dword [edx + 0x20]
push eax
push ecx
jmp 0x405bef
test eax, eax
je 0x405bf9
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 0x20]
push ecx
push eax
call fcn.00405b00
add esp, 8
add ebx, eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
xor edx, edx
inc eax
mov dx, word [ecx + 6]
add edi, 0x28
cmp eax, edx
mov dword [esp + 0x14], eax
jl 0x405ba9
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
Function at 0x918058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009181a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x91807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x91806a
add dl, dl
jne 0x918089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9180dc
xor eax, eax
add dl, dl
jne 0x918096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x91817d
add dl, dl
jne 0x9180a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9180b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9180bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9180c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9180d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x918075
mov eax, 1
add dl, dl
jne 0x9180ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9180f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9180e1
sub eax, ebx
mov ebx, 1
jne 0x918128
mov ecx, 1
add dl, dl
jne 0x91810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x918119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x918105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x918075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x91813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x91814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x918136
cmp eax, 0x7d00
jae 0x91816d
cmp eax, 0x500
jb 0x918168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x918075
cmp eax, 0x7f
ja 0x918170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x918075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x91819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x918075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x51441a
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
jmp 0x514ed9
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x51507e
shl eax, 8
lodsb al, byte [esi]
call fcn.0051513d
cmp eax, 0x7d00
jmp 0x514f4c
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
jmp 0x5152c1
xor eax, eax
call fcn.00515083
jae 0x515370
mov bl, 2
inc ecx
jmp 0x514d4f
jne 0x51443d
stosb byte es:[edi], al
jmp 0x5152c3
call fcn.005147fd
jmp 0x5151f7
xchg ebp, eax
mov eax, ebp
mov bl, 1
jmp 0x51443d
cmp eax, 0x7f
ja 0x514b92
inc ecx
inc ecx
jmp 0x514b92
mov al, 0x10
call fcn.00515083
adc al, al
jae 0x514d51
jmp 0x5148f9
xor ecx, ecx
call fcn.00515083
jae 0x514905
jmp 0x5148d1
mov ebp, esp
pushal
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
jmp 0x5147e4
jmp 0x514ce4
xchg ecx, eax
dec eax
jmp 0x5147c2
jae 0x514ce4
cmp ah, 5
jae 0x514ce5
jmp 0x514cdb
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
leave
jmp 0x515362
jmp 0x5152c3
sub ecx, ebx
jne 0x514f31
call fcn.0051513d
jmp 0x51536b
mov bl, 2
call fcn.00515083
jae 0x5147e9
jmp 0x514d5f
ret 8
jmp 0x514b93
lodsb al, byte [esi]
shr eax, 1
je 0x51500d
adc ecx, ecx
jmp 0x514f2c

Function at 0x5145fe
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
xor edi, edi
cmp edx, ebx
jmp 0x514cc6
push ebp
jmp 0x5153ab
or ecx, ecx
jne 0x514d8a
cmp edi, dword [ebp + 8]
jne 0x515146
mov eax, dword [edx + 0x18]
jmp 0x515144
ja 0x514ade
and eax, 0xffffffdf
add edi, eax
dec ecx
jmp 0x514922
mov edx, dword fs:[0x30]
mov edx, dword [edx + 0xc]
lea edx, [edx + 0xc]
mov ebx, edx
mov edx, dword [edx]
jmp 0x514396
jne 0x514ccd
jmp 0x51514b
lea esi, [edx + 0x2c]
movzx ecx, word [esi]
mov esi, dword [esi + 4]
jmp 0x514d83
shr ecx, 1
jmp 0x514922
rol edi, 7
lodsw ax, word [esi]
jmp 0x5150cc
cmp eax, 0x61
jb 0x514ade
cmp eax, 0x7a
jmp 0x514ad9
jmp 0x51514b
jmp 0x514b0c
pop edi
pop esi
jmp 0x5153cd
mov ebp, esp
push ebx
push esi
push edi
jmp 0x514afd
pop ebx
leave
ret 4

Function at 0x514734
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop edi
pop esi
pop ebx
jmp 0x5145fa
inc ecx
cmp ecx, dword [ebp - 4]
jb 0x514b8a
jmp 0x514420
mov ecx, dword [eax + 0x18]
mov dword [ebp - 4], ecx
mov ebx, dword [ebp + 0xc]
jmp 0x514b83
leave
ret 8
push ebp
jmp 0x5152b4
mov eax, dword [edi + 0x1c]
add eax, edx
mov eax, dword [eax + ecx*4]
add eax, edx
jmp 0x514420
xor eax, eax
pop ecx
add esi, 4
jmp 0x5144e4
mov edi, eax
mov esi, dword [eax + 0x20]
add esi, edx
jmp 0x514506
xor ecx, ecx
jmp 0x5144e5
push ecx
mov ecx, dword [esi]
jmp 0x514fcf
rol eax, 7
add eax, edx
inc ecx
jmp 0x515197
add ecx, edx
xor eax, eax
push edx
jmp 0x515197
movzx edx, byte [ecx]
jmp 0x514bc0
cmp byte [ecx], 0
jne 0x514fd9
pop edx
xor eax, 0
cmp eax, ebx
jmp 0x5154c8
mov ebp, esp
add esp, 0xfffffffc
push ebx
push esi
push edi
jmp 0x51540a
mov eax, dword [ebp + 8]
add eax, dword [eax + 0x3c]
mov edx, dword [ebp + 8]
mov eax, dword [eax + 0x78]
add eax, edx
jmp 0x514b25
jne 0x514ab2
mov eax, dword [edi + 0x24]
add eax, edx
pop ecx
movzx ecx, word [eax + ecx*2]
jmp 0x514762
Function at 0x51482d
Capabilities:
Access peb ldr_data

Disassembly:
pop ebx
leave
ret 0x10
jne 0x514efc
pop edi
pop esi
jmp 0x51453d
push ebp
mov ebp, esp
jmp 0x5148c6
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
jmp 0x5154b6
pop dword [esi + 0x18]
push dword [ebp + 0x10]
pop dword [esi + 0x1c]
push dword [ebp + 0x14]
jmp 0x51521b
cmp eax, edi
jne 0x515223
push dword [ebp + 8]
jmp 0x514d29
mov esi, dword [ebx + 0xc]
jmp 0x514efc
mov eax, dword [esi + 0x1c]
jmp 0x514e84
pop dword [esi + 0x20]
jmp 0x514648
mov esi, dword [esi]
cmp esi, edx
jmp 0x514642
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov edx, dword [ebx + 0xc]
jmp 0x514ef2

Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..reloc
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x33875fd4
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x3c1951be
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10014dfc
Capabilities:
Get file attributes
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10014e13
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x10014e2f
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10014e2f
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov esp, ebp
pop ebp
ret

Function at 0x10014e33
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10014e59
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10014e57
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x10014ea1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10014e87
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x10014ea1
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x14]
call fcn.1001ae71
and dword [eax], 0
jmp 0x10014e7c
mov esp, ebp
pop ebp
ret
Function at 0x10020e0f
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10020e3f
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10020e3d
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x10020e81
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [eax], 2
jmp 0x10020e6d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl 0x10020e81
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
je 0x10020e7f
jmp 0x10020e81
jmp 0x10020e62
mov esp, ebp
pop ebp
ret

Function at 0x100213b3
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100213ec
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 0
mov ecx, dword [ebp - 0xc]
call fcn.1001ae71
mov ecx, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ecx], eax
jmp 0x100213f4
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esp, ebp
pop ebp
ret