joyce8/EMBER2024-capa huggingface dataset:
Function at 0xae1b90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x544000]
push edi
or ebp, 0xffffffff
jmp 0xae1bb2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xae1bb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xae1ba8
mov eax, 1
add ebx, ebx
jne 0xae1bcb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xae1bdc
jne 0xae1bfb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xae1bfb
dec eax
add ebx, ebx
jne 0xae1be8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xae1bc0
add ebx, ebx
jne 0xae1bf7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xae1c4d
xor ecx, ecx
sub eax, 3
jb 0xae1c13
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xae1c82
sar eax, 1
mov ebp, eax
jmp 0xae1c1e
add ebx, ebx
jne 0xae1c1e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xae1bec
inc ecx
add ebx, ebx
jne 0xae1c2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xae1bec
add ebx, ebx
jne 0xae1c39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xae1c2e
jne 0xae1c4a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xae1c2e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xae1c6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xae1c5e
jmp 0xae1bae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xae1c6c
add edi, ecx
jmp 0xae1bae
pop esi
mov edi, esi
mov ecx, 0x67c8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xae1c8a
cmp byte [edi], 0xe
jne 0xae1c8a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xae1c8f
lea edi, [esi + 0x6de000]
mov eax, dword [edi]
or eax, eax
je 0xae1cfe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6f551c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6f55ec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xae1cbc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6f55f4]
or eax, eax
je 0xae1cf8
mov dword [ebx], eax
add ebx, 4
jmp 0xae1cd9
call dword [esi + 0x6f55f0]
mov ebp, dword [esi + 0x6f55f8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xae1d32
sub esp, 0xffffff80
jmp 0x567e9c
Function at 0x408b84
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4190cc]
jne 0x408b8e
repz ret
jmp fcn.0040a6e6

Function at 0x40fa03
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x40fa3e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40fa25
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x40fa36
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x40fa40
inc edi
add eax, 0x28
cmp edi, esi
jb 0x40fa1b
xor eax, eax
pop edi
pop esi
ret

Function at 0x40fde3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
aam 0x50
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040f9d3
push eax
push esi
push dword [ebp + 8]
call fcn.0040f988
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040f9c3
sar ah, 1
xor cx, word [eax - 0x8363]
dec dword [eax - 0x8263]
inc esi
test dword [esi - 1], edi
invalid
Function at 0x410898
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0040f9a1
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0040f9d3
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040f988
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0040f9c3
mov cl, 0xf2
retf

Function at 0x41136b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test cl, bh
push es
add byte [eax], al
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x41153e
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
cmp dword [ebp - 0x6fc], 1
jne 0x4115ef
invalid

Function at 0x413000
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
push ebx
push esi
push edi
mov ebx, edx
mov ecx, dword [esp + 0x10]
lea edi, [0x41a0c0]
or ebx, ecx
mov esi, edx
test ebx, 3
mov ebx, dword [edi]
jne 0x413080
add edx, ecx
shr ecx, 2
neg ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor eax, dword [edx + ecx*4]
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
inc ecx
jne 0x413040
pop edi
pop esi
pop ebx
ret 4
and esi, 3
je 0x41309d
mov bl, al
shr eax, 8
xor bl, byte [edx]
inc edx
xor eax, dword [ebx*4 + 0x41a0c0]
dec edi
je 0x4130e3
dec esi
jne 0x413088
mov esi, ecx
shr ecx, 2
je 0x4130cd
xor eax, dword [edx]
mov bl, al
shr eax, 8
inc edx
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
inc edx
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
inc edx
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
inc edx
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4130a4
and esi, 3
je 0x4130e3
mov bl, al
shr eax, 8
xor bl, byte [edx]
inc edx
xor eax, dword [edi + ebx*4]
dec esi
jne 0x4130d5
pop edi
pop esi
pop ebx
ret 4
Function at 0x413100
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
ret
Function at 0x10004160
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 4]
mov dword [ebp - 8], 1
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionNetworkPlatformLocation_Awareness
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100041c3
push 0x380
push dword [ebp + 0xc]
push 3
push eax
push str.LastBackup
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
test eax, eax
je 0x100041c9
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x100049c0
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3a0
mov eax, dword [0x10018008]
xor eax, esp
mov dword [esp + 0x39c], eax
movaps xmm0, xmmword [str.F147EC_C7F5_F89]
lea eax, [esp + 0x380]
push esi
push edi
push eax
push 1
push 0
movups xmmword [esp + 0x394], xmm0
mov dword [esp + 0x3a4], 0x394a2d41
mov dword [esp + 0x3a8], 0x44353941
mov word [esp + 0x3ac], 0x7d
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete al
test esi, esi
je 0x10004a43
test al, al
je 0x10004a59
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x39c]
xor ecx, esp
call fcn.1000599e
mov esp, ebp
pop ebp
ret
mov ecx, 0xe0
lea edi, [esp + 8]
mov esi, str.MicrosoftUpdateSystem
xor eax, eax
rep movsd dword es:[edi], dword [esi]
nop dword [eax + eax]
mov cl, byte [esp + eax + 0xc8]
lea eax, [eax + 1]
mov byte [eax + 0x1001b71f], cl
test cl, cl
jne 0x10004a70
push ecx
lea eax, [esp + 0xc]
push eax
push ecx
call fcn.10004160
mov ecx, dword [esp + 0x3b0]
add esp, 0xc
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.1000599e
mov esp, ebp
pop ebp
ret

Function at 0x10004cc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
test edi, edi
je 0x10004d2e
cmp dword [0x1001b718], 0
jne 0x10004cef
push 4
call fcn.100059af
add esp, 4
mov dword [0x1001b718], eax
mov dword [eax], 0
mov dword [eax], vtable.PluginProvider.0
push esi
push 4
call fcn.100059af
mov ecx, dword [0x1001b718]
mov esi, eax
push 8
mov dword [esi], ecx
call fcn.100059af
add esp, 8
lea ecx, [ebp - 4]
mov dword [eax + 4], edi
push ecx
push 0
push eax
push 0x10004ca0
push 0
mov dword [eax], esi
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x67fda7
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [esp - 0x82]
mov ax, word [esp + 2]
xchg dx, si
push dword [esp + 4]
jmp 0x67fd73

Function at 0x680fb7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ch, 0xef
push word [esp + 2]
mov al, byte [esp + 0x13]
mov dx, word [esp]
jmp 0x680fdf
mov si, word [esp + 9]
push ax
lea esp, [esp + 0xf]
xchg di, bp
mov edi, ebx
mov ah, dh
jmp 0x681f5b
push dword [esp + 1]
mov al, dh
shl edi, cl
lea esp, [esp + 0xb]
mov ebx, dword [esp + 5]
jmp 0x681020
xchg dword [esp + 0x12], eax
sub ebp, esp
xchg dh, al
sub esp, 0x13
mov cl, dh
push dword [esp + 0x11]
jmp 0x680ff7
rdtsc
mov dh, 0x35
cld
push dword [esp + 5]
mov byte [esp + 0x11], bh
xchg byte [esp + 0x24], dh
jmp 0x68108a
sub esp, 0x10
mov bx, word [esp + 0xe]
add esp, 0x15
mov dword [esp], eax
sub esp, 0x11
push dword [esp + 0x12]
jmp 0x68100d
clc
xchg word [esp + 0xe], bp
bsf ebp, esi
mov word [esp + 8], sp
jmp 0x6810eb
xchg ah, al
push word [esp + 0xc]
mov word [esp + 2], dx
pop word [esp + 0x15]
inc di
mov cx, di
jmp 0x681053
mov bp, word [esp + 3]
lea ebp, [ecx*4]
neg cl
xchg dl, ch
mov dword [esp + 0x25], ecx
push dword [esp + 0x13]
jmp 0x681069
sub esp, 0x1d
xchg word [esp + 9], si
xchg word [esp + 0x18], bp
xchg cl, ch
jmp 0x6810cb
xchg edi, ebx
mov bh, bl
not bp
mov dx, sp
inc dh
lea edi, [edi + 0x32]
jmp 0x6810a4
mov al, cl
lea esp, [esp + 0x11]
mov dl, al
add esp, 7
lea esp, [esp + 3]
sub esp, 0xa
jmp 0x681121
sub esp, 0xd
mov dx, word [esp + 0x3c]
lea ebp, reloc.WSOCK32.dll___WSAFDIsSet
xchg byte [esp + 0xb], cl
push word [esp + 0x3e]
lea esp, [esp + 0x41]
jmp 0x6810ba
bt edx, ebp
mov al, byte [esp + 8]
xchg dword [esp + 9], eax
mov cl, al
jmp 0x681150
lea ebp, [esp + esi]
and edx, esi
pop word [esp + 4]
push dword [esp + 3]
lea edx, [edi*4]
xchg dh, dl
jmp 0x681108
add byte [esi + 0x58ceebd6], al
pop eax
call fcn.00681237
call 0x77ed0eb2
xchg ebp, eax
cli
jle 0x681135
mov eax, dword [esi - reloc.WSOCK32.dll___WSAFDIsSet]
or byte [ebp + 0xb504], 0
add byte [edi], cl
xor dword [esi - 9], esp
xlatb
lea eax, [esi*4]
rdtsc
not di
bswap ebp
xchg bx, bp
add esp, 0xa
jmp 0x68113a
bsf ax, sp
sub esp, 0x15
btc ebp, ebx
lea esp, [esp + 0x13]
mov ebx, dword [esp + 9]
add si, cx
jmp 0x68103c
mov dh, 0x52
xchg si, bp
mov al, dh
add esp, 0
std
cpuid
jmp 0x68116c
xchg ebx, ecx
cpuid
mov word [esp], ax
not edi
mov ebx, 0xbea53d75
lea esi, [ecx + ebx]
jmp 0x681286
sub esp, 2
push dword [esp + 4]
rdtsc
add esp, 0xa
xchg byte [esp + 1], al
mov word [esp + 4], cx
jmp 0x681310
push dword [esp + 7]
btc edi, ebx
lea esi, [ebx + esi]
setle al
lea edx, reloc.WSOCK32.dll___WSAFDIsSet
stc
jmp 0x681d5c
Function at 0x68133d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ecx, [edx + ebx]
bswap esi
push word [esp + 1]
xchg bh, dl
ror ebp, 0xe
xchg ebx, eax
jmp 0x68133f
jmp 0x681327
push word [esp + 9]
bsr cx, bx
pop ebx
lea ebx, [esi + edi]
mov bh, byte [esp + 0x15]
xchg byte [esp + 0x12], dl
jmp 0x681389
bsf ebx, ecx
lea esi, [ebx + ebx]
dec dl
add esp, 2
lea esi, reloc.WSOCK32.dll___WSAFDIsSet
bswap eax
jmp 0x681373

Function at 0x68181b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov di, 0xa9c4
dec esi
setg dh
mov al, 0x46
rdtsc
jmp 0x681833
jmp 0x681805
mov ah, 0x40
mov bx, 0xd8d1
inc bp
mov bl, 0xaa
cpuid
sets dh
jmp 0x681881
cmp ebp, 0xb125f753
seto bh
mov esi, dword [esp + 2]
lea edi, [ecx*4]
pop ebp
not ebx
jmp 0x68181d
lea ecx, [ebp*4]
adc ebp, esi
inc eax
neg edx
mov esi, ecx
not bl
jmp 0x68191f
cpuid
mov esi, ecx
mov ch, 0xde
rol cl, 2
rdtsc
mov ebx, 0x226b2c07
jmp 0x68186b
std
neg bp
mov bp, word [esp]
mov dl, cl
ror bx, 0xf
inc edi
call fcn.006818e4
lea esp, [esp + 0x43]
mov bl, byte [esp]
xchg dl, ah
mov ah, 0xc5
mov ah, dh
popal
call fcn.006819e9
jge 0x681994
fisttp word [ecx + 0xf222474]
mov ebp, 0x310ffdd1
lea esp, [esp + 5]
sub esp, 0x1f
jmp 0x681933
scasb al, byte es:[edi]
mov ecx, 0x424648d
popfd
lea esp, [esp + 4]
push eax
call fcn.00681981
push edx
pushal
mov dword [esp + 0x40], ebx
push cx
push word [esp + 1]
jmp 0x6819cf
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x3c], esp
call fcn.00681a01
retf 0xc650

Function at 0x681b61
Capabilities:
Parse pe header

Disassembly:
call fcn.006810e4
mov eax, dword [eax + 8]
push eax
jmp 0x6810df
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x681a68
mov dword [esp], esi
mov dword [esp + 0x4c], edi
lea esp, [esp + 0x4c]
mov eax, dword fs:[0x30]
jmp 0x681a8c
pop dword [esp]
jmp 0x681ac3
Function at 0x41a811
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x423320]
jne 0x41a81b
repz ret
jmp fcn.0041c63c

Function at 0x41b4fb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x423320]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041833d
and dword [ebp - 0x14], 0
cmp dword [0x424784], 0
mov dword [ebp - 0x18], eax
jne 0x41b5ae
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41b656
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41b656
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x424784], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x424788], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42478c], eax
call edi
push eax
call esi
mov dword [0x424794], eax
test eax, eax
je 0x41b5ae
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x424790], eax
mov eax, dword [0x424790]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41b607
cmp dword [0x424794], ecx
je 0x41b607
push eax
call esi
push dword [0x424794]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41b607
test ebx, ebx
je 0x41b607
call edi
test eax, eax
je 0x41b5fe
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41b5fe
test byte [ebp - 8], 1
jne 0x41b607
or dword [ebp + 0x10], 0x200000
jmp 0x41b63a
mov eax, dword [0x424788]
cmp eax, dword [ebp - 0x18]
je 0x41b63a
push eax
call esi
test eax, eax
je 0x41b63a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41b63a
mov eax, dword [0x42478c]
cmp eax, dword [ebp - 0x18]
je 0x41b63a
push eax
call esi
test eax, eax
je 0x41b63a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x424784]
call esi
test eax, eax
je 0x41b656
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41b658
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041a811
leave
ret
Function at 0x5871b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00587140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00587140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00587140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00587140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x587bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x587c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x59987c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x587c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x587c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x402880
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x30
push ebx
xor ebx, ebx
push esi
push 0x8000
push ebx
push 1
push str.cityloc.dta
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], 0x8cccd0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x18], 0x6f7814
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
call fcn.004f6200
mov esi, dword [esp + 0x34]
cmp esi, ebx
je 0x4028ec
push edi
mov edi, dword [esp + 0x34]
push 0x85d170
mov eax, 0x800
call fcn.004ff910
pop edi
jmp 0x4028ff
push 0x800
push 0x85d170
lea ecx, [esp + 0x10]
call fcn.004f27d0
lea ecx, [esp + 8]
mov dword [esp + 8], 0x6f7814
call fcn.004f64c0
lea ecx, [esp + 8]
mov dword [esp + 8], 0x6f7864
call fcn.004f24a0
mov eax, dword [esp + 0x24]
add eax, 0xfffffff8
pop esi
cmp eax, ebx
pop ebx
je 0x40293e
cmp eax, 0x8cccc8
je 0x40293e
push eax
call sub.MSVCR71.dll_void___cdecl_operator_delete___void__
add esp, 4
add esp, 0x30
ret
Function at 0x42d460
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x100
test ecx, ecx
je 0x42d4af
mov edx, dword [0x86db58]
test edx, edx
je 0x42d4af
push ebx
push edi
push eax
push ecx
lea eax, [esp + 0x10]
push str._s__03X
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
mov edi, dword [0x86db58]
add esp, 0x10
lea ecx, [esp + 0x10c]
push ecx
lea ebx, [esp + 0xc]
call fcn.0051bd30
mov eax, dword [esp + 0x10c]
pop edi
pop ebx
cmp eax, 0x100
jge 0x42d4bd
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
and eax, 0xff
add esp, 0x100
ret
Function at 0x487160
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
push ebx
push esi
mov edx, dword [0x8e86ec]
push edi
push 0x200
push 0xffffffffffffffff
mov bl, al
mov eax, dword [0x85c268]
push eax
mov esi, ecx
mov ecx, dword [0x85c26c]
push ecx
push 0
push 0
push 0x300
push 0x400
push 0
push 0
push edx
call fcn.004af500
mov ecx, dword [0x7283bc]
mov al, byte [0x8c09cc]
or ecx, 0x1000
add esp, 0x2c
test al, al
mov dword [0x7283bc], ecx
je 0x4872aa
mov al, byte [0x8c09cf]
test al, al
jne 0x4872aa
mov al, byte [0x8c09ce]
test al, al
jne 0x4872aa
test bl, bl
push 0
push 0xffffffffffffffff
push 0
push 0
push 0
push 0
push 0x5c
mov edx, 0x64
push 0x1c2
je 0x4871fc
mov eax, dword [0x8ccae4]
push eax
jmp 0x487260
mov ecx, dword [0x8ccae4]
push ecx
call fcn.004bc2e0
mov eax, dword [0x8c09c8]
test eax, eax
jne 0x487216
mov eax, dword [0x8c09d8]
mov edx, dword [0x8ccae8]
push esi
push eax
push 0
push 0
push 0xf8e38e39
push 0
push 0x50
push 0x1c2
push edx
mov edx, 0x64
call fcn.004bc2e0
mov eax, dword [0x8c09c8]
mov ecx, dword [0x8ccaec]
push esi
push eax
push 0
push 0
push 0xf8e38e39
push 0
push 0x50
push 0x1c2
push ecx
mov edx, 0x64
call fcn.004bc2e0
mov eax, dword [0x8ebfd8]
push 0x44268000
push 0x41c80000
call fcn.00412840
push 0x20000000
push 0
push 0xc8
push 0x55
push 0x1ae
mov eax, 0x15555555
mov edi, 0xe0000000
mov ecx, 0x14
call fcn.004892c0
add esp, 0x14
pop edi
pop esi
pop ebx
add esp, 0x24
ret
push 0
push 0
lea eax, [esp + 0x14]
push 0
call fcn.004dc670
mov ecx, dword [0x8ccae4]
add esp, 0xc
test bl, bl
push 0
push 0xffffffffffffffff
push 0x64
je 0x4872e2
mov edx, eax
push edx
push 0
push 0xa2
push 0x19a
call fcn.004bc350
jmp 0x487355
lea eax, [esp + 0x18]
push eax
push 0
push 0xa2
push 0x19a
call fcn.004bc350
mov eax, dword [0x8c09c8]
test eax, eax
jne 0x487306
mov eax, dword [0x8c09d8]
mov ecx, dword [0x8ccae8]
push esi
push eax
push 0
push 0
push 0
push 0
push 0x96
push 0x19a
push ecx
mov edx, 0x64
call fcn.004bc2e0
mov edx, dword [0x8c09c8]
mov eax, dword [0x8ccaec]
push esi
push edx
push 0
push 0
push 0
push 0
push 0x96
push 0x19a
push eax
mov edx, 0x64
call fcn.004bc2e0
mov eax, dword [0x8ebfd8]
push 0x44268000
push 0x41c80000
call fcn.00412840
mov eax, 0xc8
mov ecx, 0x471c71c7
call fcn.004dcac0
mov edi, eax
mov ecx, edi
neg ecx
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7d00
mov esi, 1
jle 0x4873a8
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
cdq
xor eax, edx
sub eax, edx
add esi, esi
cmp eax, 0x7d00
jg 0x487391
mov edx, ecx
mov ecx, 0x1fffffff
call fcn.00495330
imul eax, esi
mov esi, 0x1ae
sub esi, eax
mov eax, edi
mov ecx, 0x20000000
call fcn.004dcac0
mov edi, 0x14
sub edi, eax
mov ecx, 0xc8
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x7d00
mov ebx, 1
jle 0x487407
lea esp, [esp]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
cdq
xor eax, edx
sub eax, edx
add ebx, ebx
cmp eax, 0x7d00
jg 0x4873f0
push 0x20000000
push 0
push 0x71c71c7
mov edx, ecx
push 0xe0000000
mov ecx, 0x71c71c7
call fcn.00495330
imul eax, ebx
add eax, 0x55
push eax
push edi
push esi
call fcn.004ad540
add esp, 0x1c
pop edi
pop esi
pop ebx
add esp, 0x24
ret