joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4065e3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x400
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00405fb7
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x406653
push esi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
mov byte [edi + 0x3ff], 0
pop esi
jne 0x406653
cmp dword [ebp + 0x18], 1
je 0x406656
cmp dword [ebp + 0x18], 2
je 0x406656
mov byte [edi], 0
pop edi
leave
ret 0x14

Function at 0x40665b
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
ret 4

Function at 0x4066be
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add byte [ebp + 0xa], dl
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4066fd
test edi, edi
jne 0x4066c9
mov byte [esi], al
jmp 0x4066ff
mov eax, esi
pop edi
pop esi
pop ebp
ret 8

Function at 0x4067fa
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40681c
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop esi
ret 4

Function at 0x406a37
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a17cc], 0
push esi
jne 0x406a71
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x406a48
mov dword [ecx*4 + 0x7a17c8], edx
inc ecx
cmp ecx, 0x100
jl 0x406a43
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x406a9b
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x7a17c8]
inc esi
sub edx, 1
jne 0x406a83
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x39296166
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x617730dd
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [0x403010]
mov dword [eax], 1
mov eax, dword [0x403014]
mov dword [eax], 1
mov eax, dword [0x403018]
mov dword [eax], 1
mov ecx, dword [0x403004]
movzx edx, word [ecx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x40107b
mov edx, dword [ecx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x40107b
add ecx, edx
movzx edx, word [ecx + 0x18]
cmp edx, 0x20b
je 0x401064
cmp edx, 0x10b
jne 0x40107b
cmp dword [ecx + 0x74], 0xf
jb 0x40107b
add ecx, 0xe8
jmp 0x401073
cmp dword [ecx + 0x84], 0xf
jb 0x40107b
add ecx, 0xf8
xor eax, eax
cmp dword [ecx], 0
setne al
push esi
mov ecx, dword [0x40300c]
cmp dword [ecx], 1
mov dword [0x405024], eax
mov eax, 2
sbb eax, 0
push eax
call sym.___set_app_type
add esp, 4
mov eax, dword [0x403040]
mov esi, dword [eax]
call sym.___p__fmode
mov dword [eax], esi
mov eax, dword [0x403038]
mov esi, dword [eax]
call sym.___p__commode
mov dword [eax], esi
call dbg._setargv
mov eax, dword [section..rdata]
cmp dword [eax], 1
jne 0x4010d3
push dbg._matherr
call dbg.__mingw_setusermatherr
add esp, 4
xor eax, eax
pop esi
ret

Function at 0x401350
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dbg.__main
mov dword [ebp - 4], 0
lea eax, str.java__jar_BalancedTierFormat.jar
mov dword [esp], eax
call sym._system
xor eax, eax
add esp, 8
pop ebp
ret

Function at 0x401950
Capabilities:
Write file on windows

Disassembly:
push esi
push eax
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
mov dword [esp], eax
push 2
call dbg.__acrt_iob_func
add esp, 4
push eax
push 1
push 0x1b
push str.Mingw_w64_runtime_failure:_n
call sym._fwrite
add esp, 0x10
push 2
call dbg.__acrt_iob_func
add esp, 4
push dword [esp]
push esi
push eax
call sym._vfprintf
add esp, 0xc
call sym._abort
int3
Function at 0x401c10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
cmp eax, 3
ja case.default.0x401c21
jmp dword [eax*4 + 0x403334]
cmp dword [0x405088], 0
je 0x401d23
push 0x40508c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4050a4]
test edi, edi
je 0x401d18
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401c6b
mov edi, dword [edi + 8]
test edi, edi
je 0x401d18
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x401c60
test esi, esi
je 0x401c60
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x401c60
cmp dword [0x405088], 0
jne 0x401ca0
push 0x40508c
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x405088], 1
jmp case.default.0x401c21
call dbg._fpreset
jmp case.default.0x401c21
cmp dword [0x405088], 0
je case.default.0x401c21
push 0x40508c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x4050a4]
test edi, edi
je 0x401d73
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401cf7
mov edi, dword [edi + 8]
test edi, edi
je 0x401d73
push dword [edi]
call ebx
mov esi, eax
call ebp
test eax, eax
jne 0x401cf0
test esi, esi
je 0x401cf0
mov ecx, dword [edi + 4]
call dword [section..00cfg]
push esi
call ecx
add esp, 4
jmp 0x401cf0
push 0x40508c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x405088]
cmp eax, 1
jne case.default.0x401c21
mov eax, dword [0x4050a4]
test eax, eax
je 0x401d52
nop word cs:[eax + eax]
mov esi, dword [eax + 8]
push eax
call sym._free
add esp, 4
mov eax, esi
test esi, esi
jne 0x401d40
mov dword [0x4050a4], 0
mov dword [0x405088], 0
push 0x40508c
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp case.default.0x401c21
push 0x40508c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x401eb0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push edi
push esi
mov esi, dword [0x403004]
movzx ecx, word [esi]
xor eax, eax
cmp ecx, 0x5a4d
jne 0x401f16
mov ecx, dword [esi + 0x3c]
cmp dword [esi + ecx], 0x4550
jne 0x401f16
add esi, ecx
movzx ecx, word [esi + 0x18]
cmp ecx, 0x10b
jne 0x401f16
movzx ecx, word [esi + 6]
test ecx, ecx
je 0x401f16
mov edx, dword [esp + 0xc]
sub edx, dword [0x403004]
movzx edi, word [esi + 0x14]
add esi, edi
add esi, 0x18
jmp 0x401f06
add esi, 0x28
dec ecx
je 0x401f16
mov edi, dword [esi + 0xc]
cmp edi, edx
ja 0x401f00
add edi, dword [esi + 8]
cmp edi, edx
jbe 0x401f00
mov eax, esi
pop esi
pop edi
ret
Function at 0x504950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
lea edi, [ebp - 0x100]
mov ecx, 0x40
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x79208c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x18], 0x4b
mov byte [ebp - 0x17], 0x45
mov byte [ebp - 0x16], 0x52
mov byte [ebp - 0x15], 0x4e
mov byte [ebp - 0x14], 0x45
mov byte [ebp - 0x13], 0x4c
mov byte [ebp - 0x12], 0x33
mov byte [ebp - 0x11], 0x32
mov byte [ebp - 0x10], 0x2e
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0xc], 0
mov byte [ebp - 0x30], 0x4c
mov byte [ebp - 0x2f], 0x6f
mov byte [ebp - 0x2e], 0x61
mov byte [ebp - 0x2d], 0x64
mov byte [ebp - 0x2c], 0x4c
mov byte [ebp - 0x2b], 0x69
mov byte [ebp - 0x2a], 0x62
mov byte [ebp - 0x29], 0x72
mov byte [ebp - 0x28], 0x61
mov byte [ebp - 0x27], 0x72
mov byte [ebp - 0x26], 0x79
mov byte [ebp - 0x25], 0x41
mov byte [ebp - 0x24], 0
mov esi, esp
lea eax, [ebp - 0x30]
push eax
mov edi, esp
lea ecx, [ebp - 0x18]
push ecx
call dword [0x79b948]
cmp edi, esp
call fcn.004f4250
push eax
call dword [0x79b670]
cmp esi, esp
call fcn.004f4250
mov dword [ebp - 0x3c], eax
cmp dword [ebp + 8], 0
je 0x504a2b
mov esi, esp
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x79b670]
cmp esi, esp
call fcn.004f4250
jmp 0x504a7d
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
call dword [0x79b948]
cmp esi, esp
call fcn.004f4250
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
jne 0x504a5a
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
call dword [ebp - 0x3c]
cmp esi, esp
call fcn.004f4250
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
je 0x504a7b
mov esi, esp
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [0x79b670]
cmp esi, esp
call fcn.004f4250
jmp 0x504a7d
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x504aac]
call fcn.004eff9d
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f244b
add esp, 0x100
cmp ebp, esp
call fcn.004f4250
mov esp, ebp
pop ebp
ret
Function at 0x504b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push ebx
push esi
push edi
lea edi, [ebp - 0x140]
mov ecx, 0x50
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x79208c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x18], 0x4b
mov byte [ebp - 0x17], 0x45
mov byte [ebp - 0x16], 0x52
mov byte [ebp - 0x15], 0x4e
mov byte [ebp - 0x14], 0x45
mov byte [ebp - 0x13], 0x4c
mov byte [ebp - 0x12], 0x33
mov byte [ebp - 0x11], 0x32
mov byte [ebp - 0x10], 0x2e
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0xc], 0
mov byte [ebp - 0x30], 0x47
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x50
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x6f
mov byte [ebp - 0x2a], 0x63
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x73
mov byte [ebp - 0x27], 0x73
mov byte [ebp - 0x26], 0x48
mov byte [ebp - 0x25], 0x65
mov byte [ebp - 0x24], 0x61
mov byte [ebp - 0x23], 0x70
mov byte [ebp - 0x22], 0
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0
call fcn.004f1b81
add esp, 0xc
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x50], 0x48
mov byte [ebp - 0x4f], 0x65
mov byte [ebp - 0x4e], 0x61
mov byte [ebp - 0x4d], 0x70
mov byte [ebp - 0x4c], 0x52
mov byte [ebp - 0x4b], 0x65
mov byte [ebp - 0x4a], 0x41
mov byte [ebp - 0x49], 0x6c
mov byte [ebp - 0x48], 0x6c
mov byte [ebp - 0x47], 0x6f
mov byte [ebp - 0x46], 0x63
mov byte [ebp - 0x45], 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0
call fcn.004f1b81
add esp, 0xc
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x70], 0x48
mov byte [ebp - 0x6f], 0x65
mov byte [ebp - 0x6e], 0x61
mov byte [ebp - 0x6d], 0x70
mov byte [ebp - 0x6c], 0x41
mov byte [ebp - 0x6b], 0x6c
mov byte [ebp - 0x6a], 0x6c
mov byte [ebp - 0x69], 0x6f
mov byte [ebp - 0x68], 0x63
mov byte [ebp - 0x67], 0
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0
call fcn.004f1b81
add esp, 0xc
mov dword [ebp - 0x7c], eax
cmp dword [ebp + 8], 0
je 0x504c9c
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
mov edi, esp
call dword [ebp - 0x3c]
cmp edi, esp
call fcn.004f4250
push eax
call dword [ebp - 0x5c]
cmp esi, esp
call fcn.004f4250
jmp 0x504cbb
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
push 0
mov edi, esp
call dword [ebp - 0x3c]
cmp edi, esp
call fcn.004f4250
push eax
call dword [ebp - 0x7c]
cmp esi, esp
call fcn.004f4250
push edx
mov ecx, ebp
push eax
lea edx, [0x504cec]
call fcn.004eff9d
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f244b
add esp, 0x140
cmp ebp, esp
call fcn.004f4250
mov esp, ebp
pop ebp
ret
Function at 0x504dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
lea edi, [ebp - 0x120]
mov ecx, 0x48
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x79208c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x18], 0x4b
mov byte [ebp - 0x17], 0x45
mov byte [ebp - 0x16], 0x52
mov byte [ebp - 0x15], 0x4e
mov byte [ebp - 0x14], 0x45
mov byte [ebp - 0x13], 0x4c
mov byte [ebp - 0x12], 0x33
mov byte [ebp - 0x11], 0x32
mov byte [ebp - 0x10], 0x2e
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0xc], 0
mov byte [ebp - 0x30], 0x47
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x50
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x6f
mov byte [ebp - 0x2a], 0x63
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x73
mov byte [ebp - 0x27], 0x73
mov byte [ebp - 0x26], 0x48
mov byte [ebp - 0x25], 0x65
mov byte [ebp - 0x24], 0x61
mov byte [ebp - 0x23], 0x70
mov byte [ebp - 0x22], 0
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0
call fcn.004f1b81
add esp, 0xc
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x50], 0x48
mov byte [ebp - 0x4f], 0x65
mov byte [ebp - 0x4e], 0x61
mov byte [ebp - 0x4d], 0x70
mov byte [ebp - 0x4c], 0x46
mov byte [ebp - 0x4b], 0x72
mov byte [ebp - 0x4a], 0x65
mov byte [ebp - 0x49], 0x65
mov byte [ebp - 0x48], 0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0
call fcn.004f1b81
add esp, 0xc
mov dword [ebp - 0x5c], eax
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0
mov edi, esp
call dword [ebp - 0x3c]
cmp edi, esp
call fcn.004f4250
push eax
call dword [ebp - 0x5c]
cmp esi, esp
call fcn.004f4250
push edx
mov ecx, ebp
push eax
lea edx, [0x504ef4]
call fcn.004eff9d
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f244b
add esp, 0x120
cmp ebp, esp
call fcn.004f4250
mov esp, ebp
pop ebp
ret
Function at 0x505630
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push ebx
push esi
push edi
lea edi, [ebp - 0x13c]
mov ecx, 0x4f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x79208c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x18], 0x4b
mov byte [ebp - 0x17], 0x45
mov byte [ebp - 0x16], 0x52
mov byte [ebp - 0x15], 0x4e
mov byte [ebp - 0x14], 0x45
mov byte [ebp - 0x13], 0x4c
mov byte [ebp - 0x12], 0x33
mov byte [ebp - 0x11], 0x32
mov byte [ebp - 0x10], 0x2e
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xd], 0x6c
mov byte [ebp - 0xc], 0
mov byte [ebp - 0x30], 0x56
mov byte [ebp - 0x2f], 0x69
mov byte [ebp - 0x2e], 0x72
mov byte [ebp - 0x2d], 0x74
mov byte [ebp - 0x2c], 0x75
mov byte [ebp - 0x2b], 0x61
mov byte [ebp - 0x2a], 0x6c
mov byte [ebp - 0x29], 0x41
mov byte [ebp - 0x28], 0x6c
mov byte [ebp - 0x27], 0x6c
mov byte [ebp - 0x26], 0x6f
mov byte [ebp - 0x25], 0x63
mov byte [ebp - 0x24], 0
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0
call fcn.004f1b81
add esp, 0xc
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x60], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
movzx edx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x48], 0
jmp 0x50570e
mov eax, dword [ebp - 0x48]
add eax, 1
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x78]
add ecx, 0x28
mov dword [ebp - 0x78], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x48], edx
jge 0x5057cb
mov eax, dword [ebp - 0x78]
cmp dword [eax + 0x10], 0
jne 0x505779
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0x54], ecx
cmp dword [ebp - 0x54], 0
jle 0x505777
mov esi, esp
push 4
push 0x1000
mov eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x78]
mov edx, dword [ebp - 0x60]
add edx, dword [ecx + 0xc]
push edx
call dword [ebp - 0x3c]
cmp esi, esp
call fcn.004f4250
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x6c]
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x54]
push eax
push 0
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.004f6fd7
add esp, 0xc
jmp 0x5056fc
mov esi, esp
push 4
push 0x1000
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x60]
add eax, dword [edx + 0xc]
push eax
call dword [ebp - 0x3c]
cmp esi, esp
call fcn.004f4250
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x78]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.004f5dee
add esp, 0xc
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x6c]
mov dword [eax + 8], ecx
jmp 0x5056fc
push edx
mov ecx, ebp
push eax
lea edx, [0x5057fc]
call fcn.004eff9d
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f244b
add esp, 0x13c
cmp ebp, esp
call fcn.004f4250
mov esp, ebp
pop ebp
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x18ee6da2
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x671e3a72
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x403e59
pop dword [ebp - 0x44]
mov eax, 0xe4400a25
add eax, 0x1c003434
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xeac867a7
sub dword [ebp - 0x54], 0x9c76225c
mov dword [ebp - 0x50], 0x644c1b7f
add dword [ebp - 0x50], 0xcde730c6
mov dword [ebp - 0x4c], 0xdcd7a71f
sub dword [ebp - 0x4c], 0x908b62f1
mov dword [ebp - 0x48], 0x63794518
sub dword [ebp - 0x48], 0x63794518
lea eax, [ebp - 0x54]
push eax
mov eax, 0xe3a2c718
sub eax, 0xe362468c
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x73aaa4d4
add dword [ebp - 0x54], 0xc7c482
mov dword [ebp - 0x50], 0x2de65d6e
sub dword [ebp - 0x50], 0xec79fbf9
mov dword [ebp - 0x4c], 0xa2f3118a
add dword [ebp - 0x4c], 0xc07c5ae2
mov dword [ebp - 0x48], 0xceb093d0
sub dword [ebp - 0x48], 0xceb093d0
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xd2e7a54f
sub eax, 0xd2a7247b
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x37609
push 0
call eax
mov ecx, 0x6fed956c
sub ecx, 0x6fed4ae7
xor edi, edi
add edi, eax
mov edx, 0x426cb5ac
sub edx, 0x422ba5ac
add edx, dword [ebp - 0x44]
mov esi, 0x98c1b205
add esi, 0xd601a393
sub dword [ebp - 0x24], ecx
mov ebx, dword [edx]
sub dword [ebp - 0xc], edi
xor ebx, esi
add dword [ebp - 0x14], 0xeb50ce9b
mov dword [edi], ebx
xor dword [ebp - 4], 0xf70630e6
add edi, 0xf18e724
sub edi, 0xf18e720
add edx, 0xbcba4a29
sub edx, 0xbcba4a25
loop 0x403f7d
add eax, 0x11ce7
mov ebx, eax
add eax, 0xdc359418
add eax, 0x23ca6bed
mov ecx, 0xa9fb64bc
add ecx, 0x56449b44
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x6261b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00626140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00626140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00626140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00626140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x626bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x626c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x63887c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x626c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x626c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ed0
nop
nop
mov ecx, 0x1f2413c5
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0xbb71c00
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x48a4ec
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x48a4f2
ret