joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c1a4
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4122e4], 0
jne 0x40c225
cmp dword [0x412304], 0
jne 0x40c1d4
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x412304], eax
test eax, eax
jne 0x40c1d4
push str.GetEnvironmentStrings_failed
call fcn.0040b214
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x412304]
jmp 0x40c1e8
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0040512c
pop ecx
mov edi, eax
test eax, eax
jne 0x40c1e0
lea edi, [ebp + 1]
push edi
call fcn.00404260
pop ecx
mov ebx, eax
mov dword [0x4122e8], ebx
test ebx, ebx
jne 0x40c212
xor eax, eax
jmp 0x40c2e8
push edi
mov edx, dword [0x412304]
push edx
push ebx
call fcn.00404fdc
add esp, 0xc
jmp 0x40c245
xor esi, esi
mov ebx, dword [0x4122e4]
jmp 0x40c23f
push eax
call fcn.0040512c
pop ecx
test eax, eax
jne 0x40c23b
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40c22f
lea ebx, [esi + 4]
push 4
mov dword [0x4122ec], ebx
inc ebx
push ebx
call fcn.00404060
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40c268
xor eax, eax
jmp 0x40c2e8
cmp dword [0x4122e4], 0
jne 0x40c299
xor esi, esi
mov ebx, dword [0x4122e8]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40c28a
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0040512c
pop ecx
mov edi, eax
test eax, eax
jne 0x40c280
jmp 0x40c2ca
xor esi, esi
mov ebx, dword [0x4122e4]
mov eax, dword [esp]
mov edi, eax
jmp 0x40c2c4
push eax
call fcn.0040512c
pop ecx
test eax, eax
je 0x40c2b9
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40c2bd
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40c2a8
mov eax, dword [0x4122e4]
test eax, eax
je 0x40c2da
push eax
call fcn.00404270
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4122e4], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x414de2
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor dword [ebx], edi
add ebx, 4
or eax, ecx
sub ecx, ecx
or esi, esi
cmp ebx, edx
jne fcn.00414de2
inc ecx
add eax, 0xab2a8976
or ecx, esi
ret
Function at 0x406ca1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41e3ec]
jne 0x406cab
repz ret
jmp fcn.0040bb9c

Function at 0x41285c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41e3ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040991a
and dword [ebp - 0x14], 0
cmp dword [0x420c38], 0
mov dword [ebp - 0x18], eax
jne 0x41290f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4129b7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4129b7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x420c38], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x420c3c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x420c40], eax
call edi
push eax
call esi
mov dword [0x420c48], eax
test eax, eax
je 0x41290f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x420c44], eax
mov eax, dword [0x420c44]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x412968
cmp dword [0x420c48], ecx
je 0x412968
push eax
call esi
push dword [0x420c48]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x412968
test ebx, ebx
je 0x412968
call edi
test eax, eax
je 0x41295f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41295f
test byte [ebp - 8], 1
jne 0x412968
or dword [ebp + 0x10], 0x200000
jmp 0x41299b
mov eax, dword [0x420c3c]
cmp eax, dword [ebp - 0x18]
je 0x41299b
push eax
call esi
test eax, eax
je 0x41299b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41299b
mov eax, dword [0x420c40]
cmp eax, dword [ebp - 0x18]
je 0x41299b
push eax
call esi
test eax, eax
je 0x41299b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x420c38]
call esi
test eax, eax
je 0x4129b7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4129b9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406ca1
leave
ret
Function at 0x41ffcb
Capabilities:
Encode data using xor

Disassembly:
or cl, ah
pop edi
jnp 0x42002b
invalid
mov ebp, 0x75b6fcf7
push ss
push eax
pop ebx
loope 0x41fff9
aaa
lds ebx, [0x9b465318]
push ebx
inc esi
wait
mov ah, 0x23
out dx, al
test byte [edx - 0x33b2c84], bl
jp 0x420037
jl 0x41ffb7
invalid
in eax, 0xcd
xor eax, 0x9a65529f
push ebp
adc esi, edx
cmp ebx, ebp
and al, 0x7a
inc ebp
jl 0x41ffda
loope 0x41ffe2
imul dword [ebx - 0x54082ee9]
xor eax, 0xdce84dcd
dec ebp
invalid
fadd st(7), st(0)
cld
or ch, byte [edx - 0x43eeae56]
cmp cl, byte [edi + 0x42]
insb byte es:[edi], dx
imul ebp, dword [edx + 0x5bf8fb01], 0x69
push es
push edi
mov edx, 0x1831f932
stosb byte es:[edi], al
add ebx, edi
clc
pop ebx
imul eax, dword [esi], 0x32ba5764
stc
xor dword [eax], ebx
imul dword [esp + esi*4 + 0x28d7cd49]
and dword [ecx + 0x4d86b8f7], 0x19
mov bh, 0x95
push ecx
adc dword [esi + 0x3d], ebp
dec esp
adc eax, dword [edi - 0x3e91c440]
push 0xffffffffffffffe4
xchg ecx, eax
les esi, [edx - 0x19]
mov bh, byte [esi - 0x419b33e]
hlt

Function at 0x53f9ca
Capabilities:
Encode data using xor

Disassembly:
dec ebp
std
mov al, 0x74
push ss
pushal
sbb byte [edi - 0x12c942d4], al
fnstcw word [edx]
pop esi
insb byte es:[edi], dx
dec edx
test al, 0x55
xchg esi, eax
xchg ecx, eax
test eax, 0x3005a982
jo 0x53f99f
or al, 0x24
sub al, 0x69
pop es
arpl word [esi + 0x59cc704c], si
inc edx
cwde
push ds
salc
inc eax
or eax, 0x946976d7
xlatb
jbe 0x53fa0e
xchg esp, eax
lodsb al, byte [esi]
push es
nop
add cl, dh
test esi, 0xee1761f0
stc
jo 0x53f974
std
push esp
mov edi, dword [eax]
hlt
xchg esp, eax
mov eax, 0x85fb9a91
in al, dx
add ecx, ecx
or eax, 0x2371eaf3
xor dword [ecx - 0x76f35ccf], 0x5b567025
xor dword [ecx], ebp
das
jns 0x53f9f8
mov ebx, 0xec5514fc
fcom qword [bx - 0x78c4]
xchg edx, eax
je 0x53f9a2
adc dword [eax + 0x49], 0x205b1641
fsub dword [ecx]
and eax, 0x1edf1c0c
push ss
pop ebx
and al, bl
and dword [0x1edf1c0c], esp
out 0xfa, al
cmpsb byte [esi], byte es:[edi]
inc edi
xor dword [0x340f1cb1], ebx
jecxz 0x53f9ec
adc esp, ecx
retf 0x71fa
Function at 0x58f2a8
Capabilities:
Encode data using xor

Disassembly:
adc bh, byte [ebx - 0x585d74a3]
add byte [ebx], dl
or al, byte [edx + 0x5b]
dec esi
scasb al, byte es:[edi]
aad 0xf6
and edi, dword [eax + 0x2b00d64]
cmp al, dh
and ah, ch
adc ebx, dword [eax + edi*4]
enter 0xffffffffffffc8ab, 0xffffffffffffffd2
test al, 0xae
imul esi, dword [ecx], 0xffffffc7
xchg ebp, eax
sbb eax, 0x766af4d4
add eax, 0x4b41af78
mov ecx, edx
fmul qword [0x173083ca]
lodsb al, byte [esi]
push 8
mov dl, 0x73
sub dl, al
and dword [0xba455b36], edi
xor al, bh
sbb dword [ecx - 0x33], ecx
cmp al, 0x4f
out 0xd9, al
js 0x58f2fb
pop esp
jns 0x58f366
sub ebp, esi
mov dl, 0xc8
sub al, 0xfa
fcmovbe st(0), st(0)
push ds
mov ecx, 0x7a773def
inc ebx
cdq
push edi
jecxz 0x58f2c4
and ebx, dword [eax - 0x66db2cc3]
dec byte [edx + 0x57]
clc
rcr ecx, 1
mov ebp, 0x7154780
inc ebx
dec edx
inc byte [eax]
sub dword [ecx], edi
adc ah, byte [ebx + ebp*4 + 0x4b]
mov cl, 0x61
cmp edx, ebp
fstp xword [edi + 0x36]
salc
jne 0x58f323
out dx, al
dec esp
mov eax, 0xc04fc01b
invalid
fistp qword [ebp - 0x49f50a61]
push 0xde31974a
cmovb esp, ebp
rcl byte [esi - 0x7a4ba4d6], 0xd1
aam 0xac
xchg esi, eax
in al, dx
neg dword [ebx - 0x378effd]
mov ebp, 0x1b04c7d9
mov ebx, 0x1143d700
bound ebp, qword [edi - 0x49]
sbb esp, dword [ebp + 0x1f48a7a2]
inc ecx
mov word [0x18b45ec9], fs
in eax, 0x85
js 0x58f334
add eax, edi
stosb byte es:[edi], al
push eax
push esi
and eax, 0xea8556d9
scasd eax, dword es:[edi]
outsd dx, dword [esi]
cmp byte [edx + 0x4d8a12a], bl
or eax, 0x1464cb14
aaa
cwde
xor byte [eax], al
adc eax, 0x33b41f38
and byte [ebx], 0xf7
push ebx
enter 0xffffffffffffb8aa, 0x7b
pop edx
ror byte [eax - 0x5f930343], cl
dec ebp
and byte [esi + 0x34], dl
in eax, dx
xchg esi, eax
adc dword [ecx], 0xad983a04
mov dh, 9
das
sti
mov al, byte [0x3ef12c3b]
lodsb al, byte [esi]
inc esi
mov eax, dword [0x6bd7a9cb]
pop ds
xor dword [ebx], ebx
imul edx, dword [ecx + 0x5fc6159e], 1
or dh, byte [edi - 0x24]
cmp ch, byte [edi]
aas
imul ebx, dword [eax - 0x55], 0xf
push ds
add eax, 0x66813cd1
mov bl, byte [esi + 0x6b]
mov dh, 0x28
jno 0x58f3b2
sub ah, byte [ecx + 0x140d04d8]
retf
ret
Function at 0x5db214
Capabilities:
Encode data using xor

Disassembly:
adc dh, bh
push ss
mov eax, dword [0xd44e6bd4]
xor byte [ebx + 0x74], ah
cmp byte [ebp + 0x4fcdf3a0], dh
imul edi, dword [esi], 0xd609e737
mov byte [0x66b61f6d], dl
pop ds
mov dh, 0x66
xchg ebp, eax
mov bh, 0xeb
pop es
insb byte es:[edi], dx
pop ss
fdiv dword [ecx]
stc
push ebp
inc ecx
outsb dx, byte [esi]
pop edi
dec ebx
push ebp
jno 0x5db1dc
sbb dl, dl
pop ecx
shr byte [edx - 0x5c], cl
movsb byte es:[edi], byte [esi]
invalid
mov edi, 0xcef50bdd
xchg dword [eax - 0x6e], esp
push 0x45
dec edx
mov ah, 0xab
add dword [esi - 0x299821dd], edx
inc edx
push ecx
out 0x7a, eax
adc dword [edx + 0x25], ecx
push ebx
movsb byte es:[edi], byte ss:[esi]
enter 0xffffffffffff8539, 0
sbb dword [edx], eax
cmc
sub al, byte [esi]
and dword [edi], ebp
sti
stosb byte es:[edi], al
idiv dword [esi]
dec edx
dec edx
xchg esi, eax
mov bh, 0x18
adc dx, cx
loop 0x5db2bf
xlatb
xor al, 0x2e
xor al, byte [ecx - 0x492bc16c]
in al, 0xde
les edx, [edi*2 - 0x5d3b6219]
dec edi
pop ss
pop ds
movsd dword es:[edi], dword [esi]
inc edi
loope 0x5db241
jb 0x5db1f6
pop ss
adc dword [esi + 0x1febbb3e], 0x53
aaa
wait
je 0x5db227
inc ecx
sub esi, edi
mov dh, 0x1d
fadd dword [ebp + ecx*4 - 0x78]
jbe 0x5db210
invalid

Function at 0x60a7ad
Capabilities:
Access peb ldr_data

Disassembly:
add byte [eax - 0x7d], dl
in al, dx
adc byte [ebx + 0x56], dl
push edi
mov eax, dword [0x590630]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x30]
mov esi, dword [eax + 0x10]
add esi, dword [eax + 0xc]
mov edx, dword [edi + 0x290]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x34]
push ecx
push 0x470
xor ebx, ebx
push edx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x20], ebx
call dword [0x540884]
mov eax, dword [esp + 0x30]
cmp esi, eax
jge 0x60a803
mov esi, eax
mov eax, dword [esp + 0x10]
cmp esi, eax
jle 0x60a80d
mov esi, eax
call fcn.00623088
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x60a827
push 0x80004005
call fcn.006047c1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push ebx
mov eax, esi
cdq
push 0x7d8200
push edx
push eax
mov dword [esp + 0x38], ebx
call 0x71bbd1
mov dword [esp + 0x18], eax
mov eax, edx
and edx, 0x7fffffff
mov dword [esp + 0x1c], edx
fild qword [esp + 0x18]
and eax, 0x80000000
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
fild qword [esp + 0x18]
sub esp, 8
lea ecx, [esp + 0x1c]
fchs
faddp st(1)
fld qword [0x56dfe8]
fmul st(1), st(0)
fmulp st(1)
fstp qword [esp]
push 0x56b964
push ecx
call fcn.006057b1
mov esi, dword [esp + 0x24]
add esp, 0x10
push esi
lea ecx, [edi + 0x21c]
call int.006205da
mov edx, dword [esp + 0x34]
lea eax, [esi - 0x10]
mov dword [edx], ebx
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x60a8d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 8
Function at 0x619930
Capabilities:
Encode data using xor

Disassembly:
push esi
aad 0x1b
cli
dec dword [esp + edi*8 + 0x78af07d3]
invalid
mov fs, word [esi - 0x52]
sbb ebx, dword [ecx - 0xee4f9b3]
pop edx
and dword [ecx - 0x79022a2f], edx
inc esp
shld ebx, ecx, 0xb7
loop 0x619907
mov dl, 0xd7
fld xword [esp + esi*8 - 0xb0a7c25]
invalid

Function at 0x61cf14
Capabilities:
Encode data using xor

Disassembly:
or al, 0x8a
xor byte [edx], cl
insb byte es:[edi], dx
mov edi, 0x1a3333e7
ja 0x61cf60
out dx, eax
fbstp tbyte [ebx]
aas
mov edi, ecx
invalid
invalid

Function at 0x624511
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x981568e5
test cl, 0xc5
xor eax, 0x9e2fe22e
leave
lds esi, [0x9e2fe22e]
das
sahf
xor ch, byte [edi + 0xa]
cli
adc byte [ebp - 0x424c10a6], 0x2f
adc eax, 0xadba6458
mul ebp
or bh, byte [ebx]
aam 0xd9
push 0x46
add dh, byte [eax + 0x1b]
pop esp
loope 0x6244ec
mov edx, 0x873ab439
mov bh, byte [eax - 0x79]
add dword [ebx - 0x686358a0], esp
jle 0x6244ec
loope 0x624586
mov dl, 0x56
mov al, byte [0xdf577ce7]
clc
sbb al, 0xb0
mov bl, 0x1b
mov dh, byte [esi - 0x32]
xor dword [eax], edx
cmp eax, 0xc91d1d2a
push 0xfffffffffffffffd
xor byte [ecx], ch
mov ebx, 0xb9218a45
popal
push 0x13479c0e
cmp dword [esi], ebx
pushfd
inc edi
adc edi, dword [ecx]
push ds
xor dword [edx - 0x26e78db8], edi
inc esp
ja 0x6244f1
jg 0x6244e6
clc
or dword [eax], eax
pop edx
or byte fs:[edx + 0x5f654bc7], bh
fcom dword [edx - 0x56c84c45]
sub byte [edx + 0x7b7d9d36], 0xec
mov dword [ecx + 0x66], eax
mov ebp, 0xc06fa73d
mov ah, 0xfb
enter 0x7c55, 0xffffffffffffffe6
mov byte [0x943f3eb9], al
push edi
or esi, dword [esi]
mov esp, 0x77f76b5e
jns 0x624545
div dword [edi + 0x79]
mov ebx, 0x6f2fa7bf
mov es, word [edx + 0x3fb7aac4]
mov edi, 0x8e6f2fa7
add ah, 0xaa
mov bh, 0x3f
das
iretd
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0xd3
cdq
add dh, byte [edx - 0x4d3e662d]
rcr dword [ecx - 0x662c4d3f], cl
sal dword [edx - 0x3d9e662d], 0x83
fadd st(1)
adc bl, dh
stc
xor byte [edx - 0x4d3e66f0], 0xd3
cdq
xchg esp, eax
cmp esi, dword [esi]
adc al, byte [edx + edi*4 + 0x39cddc58]
popal
ret 0xd883
int 0x39
xchg byte [ecx - 0x37ec70bf], cl
xor byte [edx + 0x3186ecd3], 0x2b
cwde
mov bl, 0xf0
push eax
jno 0x414a3d
invalid
sub dword [ecx - 0x4b], edi
pop cx
div byte [ecx - 0x3b]
shr byte [esi], 1
jns 0x414a50
rcr dword [ecx - 0x3906a540], cl
dec ebp
cmp byte [ebp - 0x3f7c78c2], cl
xor byte [edx + 0x4c06a43b], 0x2c
sbb al, 1
invalid
xchg esp, eax
cmp esi, dword [esi]
pop edi
les esp, [edx - 0x7e]
fadd st(1)
mov bl, 0xbb
dec ecx
add esi, eax
sal ebx, cl
aaa
pop edx
test eax, 0x834d3f5c
jno 0x414b3e
je 0x414b08
js 0x414a90
xor ebx, ebx
ror dword [eax], 0xd7
jns 0x414a68
mov dl, 0x6b
test eax, 0x71d3f3a1
xchg ecx, eax
dec ebp
sub al, 0x66
sub ecx, ebp
sub al, 0x66
or al, bl
stc
xor byte [edx + 0x4d47483b], 0x2c
push eax
cmp ecx, dword [eax + 0x47]
dec ebp
sub al, 0x50
add dh, byte [edx - 0x4d3e662d]
rcr dword [ecx - 0x662c4d3f], cl
sal dword [edx + 0x4d3e99d3], 0x2c
sal word [edx + reloc.ole32.dll_CoInitializeEx], 0x2c
sal dword [edx - 0x4d3e662d], 0xd3
cdq
dec ebp
sub al, 0x66
sal dword [edx + 0x4d3e99d3], 0x2c
sal word [edx - reloc.ole32.dll_CoInitializeEx], 0xd3
cdq
sal dword [edx - 0x4d3e662d], 0x50
jne 0x414af2
jne 0x414b06
mov ebp, 0x99911a2d
enter 0xffffffffffff9c49, 0xfffffffffffffff1
rol edx, 0x92
cdq
invalid
imul eax, dword [ecx + 0x43], 0xffffff88
push ebp
and cl, byte [esi]
jecxz 0x414afa
fsub st(0), st(0)
dec ebp
xchg ebp, eax
and cl, al
mov byte [0x75409993], al
rcr byte [ecx + 0x7752b2c1], cl
sub ah, al
fstp xword [ebx + 0x40]
pop esp
rcr byte [ecx - 0x46964d3f], cl
mov dh, bl
rcr dword [eax], cl
adc byte cs:[edi], bl
lodsd eax, dword [esi]
in eax, 0xb3
sub al, 0x71
ljmp 0xbe98
Function at 0x42c3a2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
or dword [ebp - 0x14], 0xffffffff
and dword [ebp - 0x40], 0
mov dword [ebp - 8], 0x4000
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 0
push 0
push 2
call fcn.0042d515
test eax, eax
je 0x42c3dd
jmp 0x42c57e
push dword [ebp - 8]
push 0x40
call dword [0x4090b8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42c3f6
jmp 0x42c57e
mov dword [ebp - 0x3c], 0x74654e57
mov dword [ebp - 0x38], 0x6d756e45
mov dword [ebp - 0x34], 0x6f736552
mov dword [ebp - 0x30], 0x65637275
mov dword [ebp - 0x2c], 0x41
lea eax, [ebp - 0x3c]
push eax
push 0x409e70
call dword [0x409104]
push eax
call dword [0x4090f4]
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push 0
push dword [ebp - 0xc]
call fcn.0042d4d9
add esp, 0xc
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x42c555
and dword [ebp - 0x44], 0
jmp 0x42c46d
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x14]
jae 0x42c553
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax + 0xc]
and eax, 1
je 0x42c52d
or dword [ebp - 0x154], 0xffffffff
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 0x14]
push 0x409e78
lea eax, [ebp - 0x150]
push eax
call dword [0x409210]
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x150]
push eax
call dword [0x4090c4]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xffffffff
je 0x42c52d
push dword [ebp - 0x154]
call dword [0x409110]
lea eax, [ebp - 0x150]
push eax
call dword [0x409118]
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
push dword [ecx + eax + 0x14]
push 0x409a34
lea eax, [ebp - 0x150]
push eax
call dword [0x409210]
add esp, 0xc
lea eax, [ebp - 0x150]
push eax
call fcn.0042a7ed
mov eax, dword [ebp - 0x44]
shl eax, 5
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + eax + 0xc]
and eax, 2
je 0x42c54e
mov eax, dword [ebp - 0x44]
shl eax, 5
add eax, dword [ebp - 0xc]
push eax
call fcn.0042c3a2
jmp 0x42c466
jmp 0x42c560
cmp dword [ebp - 0x40], 0x103
je 0x42c560
jmp 0x42c56d
cmp dword [ebp - 0x40], 0x103
jne 0x42c432
push dword [ebp - 0xc]
call dword [0x4090a0]
push dword [ebp - 4]
call fcn.0042d50f
leave
ret 4

Function at 0x401088
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
xor eax, eax
push esi
mov esi, ecx
push edi
mov ecx, 0x1369e
lea edi, [esi + 0x10]
mov dword [esi], 0x404440
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0xc], eax
mov dword [esi + 0x4da8c], edi
mov dword [esi + 4], edi
mov dword [esi + 8], 0xffffffff
mov eax, esi
pop edi
pop esi
add esp, 0x190
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x3a06560f
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x42f314
nop
mov ecx, 0x24e04fe8
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x418f10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
sub eax, 1
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
sub eax, 1
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
sub ecx, 1
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x420de0], ecx
add edx, 1
cmp edx, 0x100
jb 0x418f12
cmp edx, 0x800
jae 0x418ffb
mov edi, edi
mov eax, dword [edx*4 + 0x4209e0]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x420de0]
add edx, 1
cmp edx, 0x800
mov dword [edx*4 + 0x420ddc], eax
jb 0x418fd0
mov dword [0x420dbc], 0x4196b0
call fcn.00419140
test eax, eax
jne 0x419018
mov dword [0x420dbc], 0x4195d0
ret

Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0x60
pushal
call 0x81722e48
out 0x5d, al
xor eax, 0xb7ccef60
sub al, byte [edi - 0x22763c8a]
xchg dword [esi - 0x3d], esi
mov ebp, ebx
mov al, byte [0xf4d79ecb]
mov cl, 0xdc
jns 0x4153df
mov word [ecx + 0x27], fs
push edi
xor eax, 0x7ebc83db
popal
aas
pop esp
inc ebp
and byte [edi + 0x789e65f4], al
jecxz 0x4153ee
cmp bh, byte [eax - 0x1d]
retf 0xa7d9
Function at 0x404508
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
sub esp, 0x120
lea ebp, [esp - 4]
mov eax, dword [0x427470]
xor eax, ebp
mov dword [ebp + 0x120], eax
push 0x20
mov eax, 0x41fdea
call fcn.00410d47
mov edi, dword [ebp + 0x12c]
mov esi, 0x104
xor ebx, ebx
push esi
lea eax, [ebp + 0x1c]
push ebx
push eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], esi
call fcn.00410400
add esp, 0xc
push ebx
lea ecx, [ebp]
mov byte [ebp - 0xd], 1
mov dword [ebp + 0x18], 0xf
call fcn.00402dc2
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x1c]
push eax
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 4], ebx
jmp 0x4045e6
cmp byte [ebp - 0xd], bl
je 0x4045a0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.004041f3
mov byte [ebp - 0xd], bl
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 1
jne 0x4045cb
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.004041f3
inc dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x1c]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x18], esi
push dword [ebp - 0x24]
call edi
test eax, eax
je 0x404580
mov eax, dword [ebp - 0x14]
cmp dword [0x4287ac], eax
jne 0x40460d
cmp dword [ebp + 0x18], 0x10
mov eax, dword [ebp + 4]
jae 0x404603
lea eax, [ebp + 4]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push ebx
push 1
lea ecx, [ebp]
call fcn.00403818
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x120]
xor ecx, ebp
call fcn.00410578
add ebp, 0x124
leave
ret 4