joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4733b0
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [ebx + 0xc]
push eax
lea ecx, [ebp - 0x20]
push ecx
call fcn.00472a60
add esp, 8
mov edx, dword [ebx + 0x10]
push edx
lea ecx, [ebx + 0xc]
call fcn.00441d10
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x473407
mov eax, dword [ebx + 8]
push eax
call fcn.0040bc70
add esp, 4
mov eax, dword [ebx + 8]
jmp 0x473543
lea ecx, [ebx + 0x14]
call fcn.00441dd0
movzx ecx, al
test ecx, ecx
jne 0x47342a
mov edx, dword [ebx + 8]
push edx
call fcn.0040bc30
add esp, 4
mov eax, dword [ebx + 8]
jmp 0x473543
lea ecx, [ebx + 0x14]
call fcn.00478540
mov ecx, eax
call fcn.0041c8d0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
jg 0x473462
jl 0x47344d
cmp dword [ebp - 0x18], 0
jae 0x473462
movzx eax, byte [0x4e359a]
push eax
lea ecx, [ebp - 0x50]
call fcn.004407e0
mov dword [ebp - 4], eax
jmp 0x473480
mov ecx, dword [ebx + 0x14]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebx + 0x18]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebx + 0x20]
mov dword [ebp - 0x34], ecx
lea edx, [ebp - 0x40]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [ebp - 0x30], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x2c], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x28], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x24], edx
lea ecx, [ebx + 0xc]
call fcn.00441d10
mov dword [ebp - 0xc], eax
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x28]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x24]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x80]
push ecx
call fcn.00437710
add esp, 0x18
mov edx, dword [eax]
mov dword [ebp - 0x64], edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x60], ecx
mov edx, dword [eax + 8]
mov dword [ebp - 0x5c], edx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x58], ecx
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x54], edx
lea eax, [ebp - 0x60]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call fcn.0040edb0
movzx ecx, al
test ecx, ecx
je 0x473518
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov edx, dword [ebx + 8]
mov dword [edx], eax
mov dword [edx + 4], ecx
mov eax, dword [ebx + 8]
jmp 0x473543
cmp dword [ebp - 0x64], 2
jne 0x473534
push 0x8a
mov eax, dword [ebx + 8]
push eax
call fcn.0041d250
add esp, 8
mov eax, dword [ebx + 8]
jmp 0x473543
mov ecx, dword [ebx + 8]
push ecx
call fcn.0040bc30
add esp, 4
mov eax, dword [ebx + 8]
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x476900
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call fcn.0044f900
movzx ecx, al
test ecx, ecx
je 0x4769b2
mov edx, dword [ebp + 0x2c]
mov eax, dword [edx]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x28]
mov edx, dword [ecx]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x24]
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0x20]
mov eax, dword [edx]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ecx]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
call fcn.00431ae0
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 8], eax
jmp 0x4769f7
mov ecx, dword [ebp + 0x2c]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0x24]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0x20]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x28
Function at 0x485f20
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x485f4c
mov dword [ebp - 4], 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call fcn.00485ee0
mov esp, ebp
pop ebp
ret 8

Function at 0x49e830
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.0049e450
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x49e862
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x4dc2b0]
call dword [ebp - 8]
jmp 0x49e86c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x4c2510
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.004c1e10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4c2544
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x4dc2b0]
call dword [ebp - 8]
jmp 0x4c254a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4

Function at 0x4c25a0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.004c1e50
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4c25d4
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x4dc2b0]
call dword [ebp - 8]
jmp 0x4c25de
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4

Function at 0x4c25f0
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.004c1e70
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4c2628
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x4dc2b0]
call dword [ebp - 8]
jmp 0x4c2636
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8
Function at 0x4c7100
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.004c6fa0
lea ecx, [ebp - 4]
call fcn.004c6fe0
movzx eax, al
test eax, eax
jne 0x4c713d
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 4]
call fcn.004c6fc0
mov eax, dword [ebp - 0x14]
jmp 0x4c71f7
lea ecx, [ebp - 4]
call fcn.004c70a0
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004c7060
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0xc]
sar edx, 1
mov dword [ebp - 0x10], edx
push 0x40
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov eax, dword [ebp - 0x10]
shl eax, 1
push eax
call fcn.004b78e0
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.00489ea0
lea ecx, [ebp - 8]
call fcn.00489f30
movzx ecx, al
test ecx, ecx
jne 0x4c71ad
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 8]
call fcn.00489ef0
lea ecx, [ebp - 4]
call fcn.004c6fc0
mov eax, dword [ebp - 0x1c]
jmp 0x4c71f7
lea ecx, [ebp - 4]
call fcn.004c70a0
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 8]
call fcn.00489fe0
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x10]
shl edx, 1
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.0048d520
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.004b9470
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 8]
call fcn.00489ef0
lea ecx, [ebp - 4]
call fcn.004c6fc0
mov eax, dword [ebp - 0x28]
mov esp, ebp
pop ebp
ret
Function at 0x4cd4e0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.0048b6b0
mov eax, dword [0x50b230]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x514cf8]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x4cd6b8
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x4cd607
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x4cd607
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x4cd5e5
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x4cd569
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4cd671
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x4cd6d8
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x4cd6b3
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x4cd6d8
jmp 0x4cd542
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ab20
mov esp, ebp
pop ebp
ret
Function at 0x4cd6f0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.0048b6b0
mov eax, dword [0x50b230]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x514cf8]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x4cd8db
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x4cd826
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x4cd826
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x4cd802
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x4cd779
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4cd894
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x4cd8fb
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x4cd8d6
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x4cd8fb
jmp 0x4cd752
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ab20
mov esp, ebp
pop ebp
ret
Function at 0x408936
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop edi
call fcn.00408956
xor dword [esi], edi
inc esi
mov edx, 0x2d13e43a
cmp esi, ecx
jne fcn.00408936
add ebx, edx
add ebx, 0x3e61de5d
ret

Function at 0xfdfcfc
Capabilities:
Encode data using xor

Disassembly:
jmp 0xfdfd06
pushal
call 0xfdfd0c
pop ebp
sub ebp, 0x10
sub ebp, 0xbdfcfc
jmp 0xfdfd22
mov eax, 0xbdfcfc
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c0
mov edx, 0xab11e68d
xor byte [eax], dl
inc eax
dec ecx
jne 0xfdfd39
jmp 0xfdfd4c
push es
inc eax
push es
add al, 0xb1
lea ecx, [ebp + 0x754c0c8d]
lea ecx, [ebp + 0x35408e8d]
mov dword [ebp - 0x5ac87273], ecx
lea ecx, [ebp - 0x71908573]
inc ebp
push es
or al, 0x81
lea ecx, [ebp + 0x488e8d]
jmp 0x8a026f21
Function at 0x100029e9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x18]
push edi
push esi
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jle 0x10002a1e
and eax, 0xffff
or eax, 0x80070000
test eax, eax
js 0x10002a57
mov edx, dword [ebp - 4]
test edi, edi
jne 0x10002a2b
test esi, esi
jmp 0x10002a45
test esi, esi
je 0x10002a4e
cmp edx, 1
je 0x10002a39
cmp edx, 2
jne 0x10002a4e
mov ecx, dword [edi]
cmp ecx, 2
jb 0x10002a47
cmp word [ecx + esi - 2], bx
je 0x10002a4e
mov eax, 0x8000ffff
jmp 0x10002a57
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10002a57
mov dword [ecx], edx
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x100058e1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [eax + 0x56fffffc], edi
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.10005089
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000503e
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
cld
invalid
inc dword [eax]
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
test dword [ebp - 4], eax
invalid
inc dword [edx]
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
jmp dword [eax]
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.10005089
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1000503e
invalid
invalid
Function at 0x10007a7b
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x100096e0], eax
mov dword [0x100096dc], ecx
mov dword [0x100096d8], edx
mov dword [0x100096d4], ebx
mov dword [0x100096d0], esi
mov dword [0x100096cc], edi
mov word [0x100096f8], ss
mov word [0x100096ec], cs
mov word [0x100096c8], ds
mov word [0x100096c4], es
mov word [0x100096c0], fs
mov word [0x100096bc], gs
pushfd
pop dword [0x100096f0]
mov eax, dword [ebp]
mov dword [0x100096e4], eax
mov eax, dword [ebp + 4]
mov dword [0x100096e8], eax
lea eax, [ebp + 8]
mov dword [0x100096f4], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10009630], 0x10001
mov eax, dword [0x100096e8]
mov dword [0x100095e4], eax
mov dword [0x100095d8], 0xc0000409
mov dword [0x100095dc], 1
mov eax, dword [0x10001a44]
mov dword [ebp - 0x328], eax
mov eax, dword [0x100094f0]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x10009628], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x10001c64
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x10009628], 0
jne 0x10007b67
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4a9e7eeb
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x1c085650
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x404e05
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00404fb5
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x404f03
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x404ea6
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x404ee9
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x404ebd
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x404ed8
test al, 0x40
je 0x404ecf
mov ecx, dword [edi + 0x20]
jmp 0x404ed6
test al, 0x80
je 0x404ee9
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x404ee9
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x404e75
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret