joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4486f0
Capabilities:
Check if file exists
Compare security identifiers
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4b571c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x448817
test al, 0x10
je 0x448817
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
mov word [ebp - 8], 0x100
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x448817
push dword [ebp - 0x28]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x10], 0
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.ADVAPI32.dll_BuildTrusteeWithSidW]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x24], 0
push eax
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x30], 0
push eax
push 0
push 0
push 4
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
test eax, eax
jne 0x44880e
mov ecx, dword [ebp - 0x24]
push esi
xor esi, esi
cmp ax, word [ecx + 4]
jae 0x4487ef
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_DeleteAce]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x4487e2
mov eax, dword [ebp - 0x2c]
add eax, 8
push eax
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4487e2
push esi
push dword [ebp - 0x24]
call edi
mov ecx, dword [ebp - 0x24]
inc esi
movzx eax, word [ecx + 4]
cmp esi, eax
jl 0x4487b1
pop edi
push 0
push ecx
push 0
push 0
push reloc.OLEAUT32.dll_SysReAllocStringLen
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop ebx
call fcn.004512f7
mov esp, ebp
pop ebp
ret
Function at 0x44af90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48ede7
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4b571c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4cb200]
test eax, eax
jne 0x44b13b
push 0xc
call fcn.00451308
mov esi, eax
add esp, 4
mov dword [ebp - 0x3c], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x44b131
xorps xmm0, xmm0
lea eax, [ebp - 0x2c]
movq qword [esi], xmm0
mov dword [esi + 8], 0
push 1
push eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x38], 0xc
push str.Global_asusatkexcom
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x38]
push 0
push eax
mov dword [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x14]
sete al
mov byte [esi + 8], al
call fcn.00448520
push 0x20219
push str.SOFTWAREWOW6432NodeASUSARMOURY_CRATE_Diagnosis
push reloc.ATKEX.dll_Ordinal_2
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 0
call fcn.00448550
lea eax, [ebp - 0x18]
push eax
push str.EnableLog
lea ecx, [ebp - 0x14]
call fcn.00448570
lea ecx, [ebp - 0x14]
call fcn.00448530
mov eax, dword [ebp - 0x18]
cmp eax, 6
je 0x44b0ac
cmp eax, 4
jne 0x44b0e8
mov ecx, esi
call fcn.0044d0e0
push 0x20206
push str.SOFTWAREASUSAXSP
push reloc.ATKEX.dll_Ordinal_2
lea ecx, [ebp - 0x14]
call fcn.00448550
push 6
push str.EnableLog
lea ecx, [ebp - 0x14]
call fcn.004485d0
lea ecx, [ebp - 0x14]
call fcn.00448530
mov ecx, esi
call fcn.0044d5a0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push eax
mov dword [0x4cb20c], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x4cb208
push 0
push esi
push 0x448830
push 0
push 0
call fcn.00474245
add esp, 0x18
mov dword [0x4cb204], eax
mov ecx, esi
call fcn.0044dce0
lea ecx, [ebp - 0x14]
call fcn.00448530
jmp 0x44b133
xor esi, esi
mov dword [0x4cb200], esi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004512f7
mov esp, ebp
pop ebp
ret
Function at 0x44b1f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48ee42
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x4b571c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x438], esi
mov dword [ebp - 0x41c], 0
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 4], 2
mov dword [ebp - 0x414], 0x400
mov word [esi], ax
cmp dword [ebp + 0x20], 8
lea ecx, [ebp - 0x418]
push ecx
push dword [ebp + 0x3c]
lea eax, [ebp + 0xc]
mov dword [ebp - 0x41c], 1
cmovae eax, dword [ebp + 0xc]
push 0
push eax
push reloc.ATKEX.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44b368
cmp dword [ebp + 0x38], 8
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x410]
push ecx
push 0
lea eax, [ebp + 0x24]
cmovae eax, dword [ebp + 0x24]
push 0
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44b368
lea ecx, [ebp - 0x410]
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x420], 7
lea edx, [ecx + 2]
mov word [ebp - 0x434], ax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44b2e0
sub ecx, edx
lea eax, [ebp - 0x410]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x434]
call fcn.00404660
lea eax, [ebp - 0x434]
cmp esi, eax
je 0x44b347
mov ecx, esi
call fcn.004036f0
movups xmm0, xmmword [ebp - 0x434]
xor eax, eax
mov word [ebp - 0x434], ax
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x424]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x420], 7
lea ecx, [ebp - 0x434]
call fcn.004036f0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x418], eax
jmp 0x44b36e
mov eax, dword [ebp - 0x418]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 0x20]
cmp edx, 8
jb 0x44b3ab
mov ecx, dword [ebp + 0xc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44b3a1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44b413
push edx
push ecx
call fcn.00451338
add esp, 8
mov edx, dword [ebp + 0x38]
xor eax, eax
mov dword [ebp + 0x1c], 0
mov dword [ebp + 0x20], 7
mov word [ebp + 0xc], ax
cmp edx, 8
jb 0x44b3f5
mov ecx, dword [ebp + 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x44b3eb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44b418
push edx
push ecx
call fcn.00451338
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004512f7
mov esp, ebp
pop ebp
ret 0x38
call fcn.0046c98c
call fcn.0046c98c
int3
Function at 0x44ed40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48f2fb
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x4b571c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x11c]
push 0x10c
push 0
push eax
call fcn.00468a50
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x114], 0
add esp, 0xc
mov dword [ebp - method.fmt::v8::basic_memory_buffer_char__250__class_std::allocator_char__.virtual_0], vtable.fmt::v8::basic_memory_buffer_char__250__class_std::allocator_char__.0
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x110], 0xfa
mov ecx, dword [esi + 8]
lea edx, [ebp - 0x11c]
push edx
push edi
mov dword [ebp - 4], 0
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x114]
lea eax, [ecx + 1]
cmp eax, dword [ebp - 0x110]
jbe 0x44edef
push eax
mov eax, dword [ebp - 0x11c]
lea ecx, [ebp - 0x11c]
call dword [eax]
mov ecx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x118]
mov byte [ecx + eax], 0
push dword [ebp - 0x118]
inc dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x118]
lea eax, [ebp - 0x10c]
mov dword [ebp - method.fmt::v8::basic_memory_buffer_char__250__class_std::allocator_char__.virtual_0], vtable.fmt::v8::basic_memory_buffer_char__250__class_std::allocator_char__.0
cmp ecx, eax
je 0x44ee4f
mov edx, dword [ebp - 0x110]
mov eax, ecx
cmp edx, 0x1000
jb 0x44ee45
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44ee6c
push edx
push ecx
call fcn.00451338
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004512f7
mov esp, ebp
pop ebp
ret 4
call fcn.0046c98c
int3

Function at 0x4546fe
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x401e30
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call 0x401ea0
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov edx, 2
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x3c]
cmp word [eax + ecx + 0x5c], 2
je 0x401e80
mov edx, 1
mov dword [esp], edx
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00401350
mov dword [esp], eax
call sub.ucrtbase.dll_exit
jmp dword [sym.imp.ucrtbase.dll___p___argc]
Function at 0x421748
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4217a1
test eax, edx
je 0x4217a4
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x42175f
movzx eax, word [eax]
sub eax, ecx
jmp 0x421786
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [eax + ecx]
xor ebx, dword [edx + ecx]
jne 0x421787
add ecx, 4
js 0x421777
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x421784
movzx eax, word [eax + ecx]
movzx edx, word [edx + ecx]
sub eax, edx
pop ebx
pop ebx
jmp 0x421786
xor eax, eax
ret
test eax, eax
je 0x4217b0
test edx, edx
jne 0x421750
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x42bae8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.0040af9c
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00410ce8
mov edi, eax
cmp edi, 0x104
jbe 0x42ba93
mov eax, edi
add eax, eax
call fcn.00406e18
mov esi, eax
jmp 0x42ba95
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00410ce8
push esi
call fcn.004139a0
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x42bace
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x42bab8
mov eax, esp
cmp esi, eax
je 0x42badb
mov eax, esi
call fcn.00406e34
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x42bb14
cmp bl, 0
je 0x42bb10
cmp bl, 0x41
jl 0x42bb0b
cmp bl, 0x5a
jg 0x42bb0b
or bl, 0x20
xor al, bl
inc esi
jmp 0x42baef
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x42ba54
Function at 0x42ebdc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42ebfa
mov eax, dword [eax - 4]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x42ec12
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42ec0d
mov eax, dword [eax - 4]
mov dword [ebp - 8], eax
jmp 0x42ec17
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x42ec85
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x42ecce
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42ec43
inc dword [ebp - 0xc]
jmp 0x42ec5b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x42ec5b
cmp dword [ebp - 0xc], 0
jle 0x42ec5b
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x42ec7d
xor eax, eax
jmp 0x42ec79
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42ec78
mov eax, esi
jmp 0x42ecd1
inc eax
cmp eax, ecx
jle 0x42ec65
inc esi
cmp esi, dword [ebp - 8]
jl 0x42ec2f
jmp 0x42ecce
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x42ecce
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42eca6
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x42ecc8
xor eax, eax
jmp 0x42ecc4
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42ecc3
mov eax, esi
jmp 0x42ecd1
inc eax
cmp eax, ecx
jle 0x42ecb0
inc esi
cmp esi, dword [ebp - 8]
jl 0x42ec8e
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42eec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov word [ebp - 0xa], cx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x42eedd
mov eax, dword [eax - 4]
mov esi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42eeeb
mov eax, dword [eax - 4]
mov ebx, eax
sub ebx, dword [ebp + 8]
sub ebx, esi
inc ebx
cmp dword [ebp + 8], 0
jl 0x42f00d
test ebx, ebx
jl 0x42f00d
test esi, esi
jle 0x42f00d
mov eax, dword [ebp - 8]
call fcn.0040b56c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040b56c
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, eax
add ecx, eax
movzx eax, word [ebp - 0xa]
cmp ax, word [ebp + 0xc]
je 0x42efaa
xor eax, eax
mov dword [ebp - 0x14], eax
test ebx, ebx
jl 0x42f00d
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42ef8f
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42ef5e
inc dword [ebp - 0x14]
jmp 0x42ef6e
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp + 0xc]
jne 0x42ef6e
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jle 0x42ef79
or eax, 0xffffffff
jmp 0x42ef8f
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42ef8c
inc eax
jmp 0x42ef8f
or eax, 0xffffffff
test eax, eax
jl 0x42ef97
cmp esi, eax
jg 0x42ef4c
cmp esi, eax
jg 0x42efa2
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42f010
inc edx
dec dword [ebp - 0x1c]
jne 0x42ef48
jmp 0x42f00d
mov byte [ebp - 0x15], 0
test ebx, ebx
jl 0x42f00d
inc ebx
mov dword [ebp - 0x1c], ebx
xor edx, edx
xor eax, eax
jmp 0x42eff4
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
cmp bx, word [ebp - 0xa]
jne 0x42efd3
movzx ebx, byte [ebp - 0x15]
xor bl, 1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x42efde
or eax, 0xffffffff
jmp 0x42eff4
lea ebx, [eax + edx]
movzx ebx, word [ecx + ebx*2]
mov edi, dword [ebp - 0x10]
cmp bx, word [edi + eax*2]
jne 0x42eff1
inc eax
jmp 0x42eff4
or eax, 0xffffffff
test eax, eax
jl 0x42effc
cmp esi, eax
jg 0x42efbc
cmp esi, eax
jg 0x42f007
mov eax, edx
add eax, dword [ebp + 8]
jmp 0x42f010
inc edx
dec dword [ebp - 0x1c]
jne 0x42efb8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43f650
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x43f658
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4422dc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x4422f3
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x4422e3
mov eax, ecx
pop ebx
ret
Function at 0x458b00
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov ebx, eax
lea eax, [ebp - 0x18]
mov edx, dword [0x44a24c]
call fcn.0040bad4
xor eax, eax
push ebp
push 0x458be4
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
xor eax, eax
call fcn.00459798
mov eax, ebx
call fcn.00459a74
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
movzx edx, byte [eax + 1]
add edx, eax
add edx, 2
mov ebx, dword [edx + 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
inc eax
cmp ebx, eax
je 0x458b52
mov ecx, 0x458c00
mov dl, 1
mov eax, dword [0x41b228]
call fcn.004294fc
call fcn.0040a19c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
movzx edx, byte [eax + 1]
add edx, eax
add edx, 2
mov eax, dword [edx + 8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x458b75
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0
jne 0x458b7a
call fcn.004570c0
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
movzx esi, byte [ecx + 1]
add esi, ecx
add esi, 2
mov eax, dword [esi]
cdq
idiv ebx
mov dword [ebp - 0x1c], eax
mov esi, ebx
dec esi
test esi, esi
jl 0x458bc6
inc esi
mov eax, dword [ebp + 8]
mov ebx, dword [eax - 0xc]
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
mov eax, ebx
mov cl, 1
call fcn.00458f00
lea eax, [ebp - 0x18]
mov edx, edi
call fcn.004599e4
mov eax, dword [ebp - 0x1c]
add edi, eax
add ebx, 0x18
dec esi
jne 0x458b9f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458beb
lea eax, [ebp - 0x18]
mov edx, dword [0x44a24c]
call fcn.0040bec0
pop eax
jmp eax
Function at 0x4d81fc
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4d83bb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040aeec
mov eax, dword [ebp - 4]
call fcn.004d7ad0
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x4d824e
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040b974
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004d91a8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4d832f
xor eax, eax
push ebp
push 0x4d8328
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004d7de8
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.004d83f0
test al, al
je 0x4d8304
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.0040ac4c
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4d8304
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040b56c
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004135f8
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004d7d48
test al, al
je 0x4d82fe
mov eax, dword [ebp - 8]
call fcn.0040b56c
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040b5cc
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.004d81fc
dec ebx
cmp ebx, 0xffffffff
jne 0x4d82ad
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d832f
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.004d7de8
mov eax, dword [ebp - 0x1c]
push eax
call fcn.004135a8
pop eax
jmp eax
cmp byte [0x4ec9e4], 0
je 0x4d836f
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.0040b56c
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004d7dd4
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004d7d48
mov ebx, eax
jmp 0x4d8396
mov eax, dword [ebp - 4]
call fcn.0040b56c
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004d7dd4
push eax
call fcn.004135e8
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004d7d48
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d83c2
lea eax, [ebp - 0x3c]
call fcn.0040aab4
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040ab14
pop eax
jmp eax
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x401d30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x4a
push dword [section..data]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
xor esi, esi
push esi
push 0xcd
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
push 0x10
push dword [section..data]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov edi, dword [esp + 0x14]
xor ebx, ebx
push esi
push 0xaa
push esi
push 0xb0
mov byte [ebx + edi], bl
push dword [section..data]
call dword [sym.imp.USER32.dll_TileWindows]
inc ebx
cmp ebx, 0x100
jl 0x401d6a
and byte [edi + 0x100], 0
push dword [0x40400c]
call dword [sym.imp.USER32.dll_GetParent]
and byte [edi + 0x101], 0
push dword [section..data]
call dword [sym.imp.USER32.dll_CloseWindow]
push 0x54
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ebp, ebp
mov eax, ebp
push dword [0x404004]
cdq
idiv dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
movzx ecx, byte [edi + ebp]
add ecx, esi
movzx eax, byte [edx + eax]
lea esi, [ecx + eax]
call dword [sym.imp.USER32.dll_GetTopWindow]
and esi, 0xff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push dword [0x404004]
movzx ebx, byte [edi + ebp]
call dword [sym.imp.USER32.dll_CloseWindow]
mov al, byte [esi + edi]
mov byte [edi + ebp], al
push dword [0x404010]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0xa9
mov byte [esi + edi], bl
push dword [0x404020]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0xf7
push dword [0x404018]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
inc ebp
cmp ebp, 0x100
jl 0x401dc4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x401ff5
Capabilities:
Terminate process

Disassembly:
push esi
push 0xd
push dword [0x404114]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x40201f
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, esi
pop esi
ret