joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40176f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401779
repz ret
jmp fcn.00401a16

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x800a980
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7000]
push edi
or ebp, 0xffffffff
jmp 0x800a9a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x800a9a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x800a998
mov eax, 1
add ebx, ebx
jne 0x800a9bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x800a9b0
jne 0x800a9cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x800a9b0
xor ecx, ecx
sub eax, 3
jb 0x800a9e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x800aa52
mov ebp, eax
add ebx, ebx
jne 0x800a9eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x800a9f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x800aa1c
inc ecx
add ebx, ebx
jne 0x800aa08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x800a9fd
jne 0x800aa19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x800a9fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x800aa3c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x800aa2d
jmp 0x800a99e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x800aa3c
add edi, ecx
jmp 0x800a99e
pop esi
mov edi, esi
mov ecx, 0x19
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x800aa5a
cmp byte [edi], 1
jne 0x800aa5a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x800aa5f
lea edi, [esi + 0x8000]
mov eax, dword [edi]
or eax, eax
je 0x800aace
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc10c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc164]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x800aa8c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc16c]
or eax, eax
je 0x800aac8
mov dword [ebx], eax
add ebx, 4
jmp 0x800aaa9
call dword [esi + 0xc168]
mov ebp, dword [esi + 0xc170]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x800ab02
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x413869
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
lea eax, [ebp - 8]
push eax
push 0x403d30
push 1
xor ebx, ebx
push ebx
push 0x403dd0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
cmp edi, ebx
jl 0x41391c
mov eax, dword [ebp - 8]
push ebx
lea edx, [ebp - 4]
push edx
push 0x401a84
mov dword [ebp - 4], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov edi, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp edi, ebx
jne 0x41391c
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x14]
mov esi, dword [ebp + 0xc]
jmp 0x413917
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
lea edx, [ebp + 0xc]
push edx
push 1
push eax
call dword [ecx + 0xc]
mov edi, eax
cmp edi, ebx
jne 0x41391b
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push esi
push 0x403d20
push ebx
push ebx
push eax
call dword [ecx + 0x20]
mov edi, eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp edi, ebx
jl 0x413917
push dword [ebp + 8]
push dword [esi]
call fcn.004137f7
mov edi, eax
cmp edi, ebx
jge 0x41391b
mov eax, dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi], ebx
cmp dword [esi], ebx
je 0x4138c7
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret 8

Function at 0x414d1a
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov eax, dword [esi + 4]
mov dword [ebp - 4], eax
mov eax, dword [esi]
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
push edi
lea ebx, [ecx + eax + 0x18]
jbe 0x414dfc
add ebx, 0x10
mov eax, dword [ebx]
test eax, eax
jne 0x414d97
mov eax, dword [ebp + 0x10]
mov edi, dword [eax + 0x38]
test edi, edi
jle 0x414de7
push dword [esi + 0x34]
mov eax, dword [ebx - 4]
add eax, dword [ebp - 4]
push 4
push 0x1000
push edi
push eax
call dword [esi + 0x1c]
test eax, eax
je 0x414e06
mov edx, dword [ebx - 4]
add edx, dword [ebp - 4]
mov ecx, edi
mov dword [ebx - 8], edx
mov edi, edx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x414de7
mov ecx, dword [ebx + 4]
add ecx, eax
mov eax, dword [ebp + 0xc]
push ecx
call fcn.00414d02
test eax, eax
je 0x414e06
push dword [esi + 0x34]
mov eax, dword [ebx - 4]
add eax, dword [ebp - 4]
push 4
push 0x1000
push dword [ebx]
push eax
call dword [esi + 0x1c]
test eax, eax
je 0x414e06
mov eax, dword [ebx - 4]
mov ecx, dword [ebx]
add eax, dword [ebp - 4]
mov esi, dword [ebx + 4]
add esi, dword [ebp + 8]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov dword [ebx - 8], eax
mov eax, dword [esi]
movzx eax, word [eax + 6]
inc dword [ebp - 8]
add ebx, 0x28
cmp dword [ebp - 8], eax
jl 0x414d47
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x10
xor eax, eax
jmp 0x414dff
Function at 0x415a3f
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4276d0]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 8
pop ecx
push 0xf0000000
push 0x18
push 0x403488
xor ebx, ebx
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x3c]
mov byte [ebp - 0x30], cl
mov byte [ebp - 0x2f], 2
mov word [ebp - 0x2e], bx
mov dword [ebp - 0x2c], 0x6610
mov dword [ebp - 0x28], 0x20
lea edi, [ebp - 0x24]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x415b2b
lea eax, [ebp + 0xc]
push eax
push ebx
push ebx
push 0x2c
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
xor edi, edi
test eax, eax
je 0x415b1f
mov esi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push ebx
lea eax, [ebp - 0x34]
push eax
push 4
push dword [ebp + 0xc]
inc edi
mov dword [ebp - 0x34], edi
call esi
test eax, eax
jne 0x415ace
xor edi, edi
jmp 0x415b16
push ebx
lea eax, [ebp - 0x34]
push eax
push 3
push dword [ebp + 0xc]
mov dword [ebp - 0x34], edi
call esi
test eax, eax
je 0x415aca
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x415af6
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [ebp - 0x38]
push ecx
push eax
push ebx
push edi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x415aca
push dword [ebp - 0x38]
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::resize_unsigned_int_]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push ebx
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004164a4
leave
ret 8
Function at 0x4164a4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4276d0]
jne 0x4164ad
ret
jmp 0x4164b2
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x4276d0]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x429964]
test eax, eax
je 0x4164d6
call eax
cmp dword [0x429968], 0
je 0x41651d
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x429968]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.004164a4
add ebp, 0x2a8
leave
ret
Function at 0x418313
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
push edi
push 5
pop ecx
mov esi, 0x404bac
lea edi, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 5
pop ecx
mov esi, 0x404b94
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, 0x404b80
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [ebp + 8]
movsw word es:[edi], word [esi]
mov esi, 0x404b6c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push ebx
push 0x404b4c
movsb byte es:[edi], byte [esi]
xor esi, esi
lea eax, [ebp - 0xc4]
push 0x64
push eax
mov dword [0x4298cc], esi
mov dword [0x4298d0], esi
mov dword [0x4298d4], esi
call fcn.004182bb
add esp, 0x10
test eax, eax
jl 0x4184b7
lea eax, [ebp + 8]
push eax
push 0x20019
push esi
lea eax, [ebp - 0xc4]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4184c0
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 4]
push eax
push 0x4298cc
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x60]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], 4
call edi
test eax, eax
je 0x4183e1
mov dword [0x4298cc], esi
lea eax, [ebp - 4]
push eax
push 0x4298d0
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x48]
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x418402
mov dword [0x4298d0], esi
lea eax, [ebp - 4]
push eax
push 0x4298d4
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x418423
mov dword [0x4298d4], esi
lea eax, [ebp - 4]
push eax
push 0x4298d8
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x418448
mov dword [0x4298d8], 0xffff0000
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4298cc], esi
jne 0x418471
cmp dword [0x4298d0], esi
jne 0x418481
cmp dword [0x4298d4], esi
jne 0x418481
xor eax, eax
inc eax
jmp 0x4184f5
cmp dword [0x4298d0], esi
jne 0x418481
cmp dword [0x4298d4], esi
je 0x4184a6
push ebx
push 0x404b48
push 0x64
push 0x429868
call fcn.004182bb
add esp, 0x10
test eax, eax
jl 0x4184b7
push esi
push ebx
call sub.rtutils.dll_TraceRegisterExW
mov dword [0x427e40], eax
cmp dword [0x4298cc], esi
jne 0x4184bb
cmp dword [0x427e40], 0xffffffff
jne 0x4184bb
xor eax, eax
jmp 0x4184f5
xor eax, eax
inc eax
jmp 0x4184f0
push ebx
push 0x404b48
push 0x64
push 0x429868
call fcn.004182bb
add esp, 0x10
test eax, eax
jl 0x4184b7
push esi
push ebx
call sub.rtutils.dll_TraceRegisterExW
mov ecx, eax
xor eax, eax
inc eax
cmp ecx, 0xffffffff
mov dword [0x427e40], ecx
je 0x4184f5
mov dword [0x4298dc], eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4184fc
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
xor esi, esi
cmp dword [0x4298cc], esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 0x201
jbe 0x418623
test dword [0x4298d8], edi
je 0x418623
cmp edi, 0x10002
je 0x418568
cmp edi, 0x20002
je 0x418565
cmp edi, 0x40002
je 0x418561
cmp edi, 0x80002
je 0x41855c
xor eax, eax
cmp edi, 0x100002
setne al
add eax, 4
mov esi, eax
jmp 0x418568
push 3
pop esi
jmp 0x418568
push 2
jmp 0x41855e
xor esi, esi
inc esi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push dword [esi*4 + 0x427e44]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
movzx eax, word [ebp - 6]
push eax
movzx eax, word [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xc]
push eax
push 0x429868
push 0x404c0c
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004182bb
add esp, 0x28
test eax, eax
jl 0x4186bb
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
call fcn.0041823b
test eax, eax
jl 0x4186bb
mov eax, dword [ebp - 4]
cmp eax, ebx
jae 0x4186bb
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
mov ecx, ebx
sub ecx, eax
push ecx
lea eax, [ebp + eax - 0x218]
push eax
call fcn.004182a0
test eax, eax
jge 0x418604
cmp eax, 0x7a
jne 0x4186bb
push 0x404c08
push ebx
lea eax, [ebp - 0x218]
push eax
call fcn.004182e2
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x427e40], 0xffffffff
je 0x4186bb
xor eax, eax
cmp dword [0x4298d0], eax
ja 0x418642
cmp dword [0x4298d4], eax
jbe 0x4186bb
cmp edi, 0x10002
je 0x41867e
cmp edi, 0x20002
je 0x41867b
cmp edi, 0x40002
je 0x418677
cmp edi, 0x80002
je 0x418672
xor eax, eax
cmp edi, 0x100002
setne al
add eax, 4
jmp 0x41867e
push 3
pop eax
jmp 0x41867e
push 2
jmp 0x418674
xor eax, eax
inc eax
push dword [ebp + 0xc]
push dword [eax*4 + 0x427e44]
lea eax, [ebp - 0x218]
push 0x404c00
push ebx
push eax
call fcn.004182bb
add esp, 0x14
test eax, eax
jl 0x4186bb
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x218]
push eax
or edi, 4
push edi
push dword [0x427e40]
call sub.rtutils.dll_TraceVprintfExA
pop edi
pop esi
pop ebx
leave
ret
Function at 0x420b0d
Capabilities:
Create thread

Disassembly:
mov eax, 0x42522d
call fcn.004167b0
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x4298dc], edi
mov esi, ecx
mov ebx, 0x80002
je 0x420b3a
push 0x40bec8
push ebx
call fcn.004184fc
pop ecx
pop ecx
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x30], edi
mov dword [ebp - 4], edi
jne 0x420bba
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, edi
mov dword [esi + 0x3c], eax
jne 0x420b7d
cmp dword [0x4298dc], edi
je 0x420b76
push 0x40bea8
push 0x10002
call fcn.004184fc
pop ecx
pop ecx
mov edi, 0x80004005
jmp 0x420bd2
lea eax, [ebp - 0x14]
push eax
push edi
push esi
push 0x420b01
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x40], eax
jne 0x420bba
cmp dword [0x4298dc], edi
je 0x420b76
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40be8c
push 0x10002
call fcn.004184fc
add esp, 0xc
jmp 0x420b76
inc dword [esi + 0x30]
cmp dword [0x4298dc], edi
je 0x420bd2
push 0x40be6c
push ebx
call fcn.004184fc
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4b5350
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4b537d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b537d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x501d80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502360
push 0x501f80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x5033f4], 0xffffffff
mov dword [0x5033f8], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x5033f0]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x5033ec]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x5033fc], ecx
call fcn.00501f70
mov eax, dword [0x503128]
test eax, eax
jne 0x501e11
push 0x501f60
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00501f40
push 0x50300c
push 0x503008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x5033e8]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x5033e4]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x503004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x501f1f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501e85
cmp al, 0x22
jne 0x501e77
cmp byte [esi], 0x22
jne 0x501e8e
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501e9e
cmp al, 0x20
ja 0x501e9e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501e8e
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x501ebf
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x501ec4
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x501f04
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x501e8e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501f1f
Function at 0x432001
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov bl, 0x20
cmp byte [esi], bl
jne 0x401018
inc esi
jmp 0x401011
xor edi, edi
cmp byte [esi], 0x2f
jne 0x401070
cmp byte [esi + 1], 0x6c
jne 0x401070
cmp byte [esi + 2], 0x69
jne 0x401070
cmp byte [esi + 3], 0x62
jne 0x401070
cmp byte [esi + 4], 0x3d
jne 0x401070
add esi, 5
cmp byte [esi], bl
jne 0x401041
inc esi
jmp 0x40103a
lea ecx, [ebp - 0x218]
mov al, byte [esi]
test al, al
je 0x401057
cmp al, bl
je 0x401057
mov byte [ecx], al
inc ecx
inc esi
jmp 0x401047
and byte [ecx], 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp byte [esi], bl
jne 0x401070
inc esi
jmp 0x401069
test edi, edi
mov dword [ebp + 0x10], 1
jne 0x4011af
cmp dword [ebp + 0x10], 2
jg 0x40119d
lea eax, [ebp - 0x110]
push str.krnl
push eax
call fcn.00401290
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
mov eax, str..fnr
je 0x4010ac
mov eax, str..fne
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.004012a0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop ecx
pop ecx
lea eax, [ebp - 0x110]
push eax
call ebx
mov edi, eax
test edi, edi
jne 0x401192
lea eax, [ebp - 4]
push eax
push 1
push edi
push str.SoftwareXingTaoEInstall
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401192
push 1
lea eax, [ebp - 0xc]
pop edi
mov dword [ebp - 0xc], 0x104
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 8]
push eax
push 0
push str.Path
mov dword [ebp - 8], edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40117e
lea eax, [ebp - 0x110]
push eax
call fcn.00401210
cmp byte [ebp + eax - 0x111], 0x5c
pop ecx
je 0x40114d
lea eax, [ebp - 0x110]
push 0x4050a8
push eax
call fcn.004012a0
pop ecx
pop ecx
lea eax, [ebp - 0x110]
push str.krnl
push eax
call fcn.004012a0
cmp dword [ebp + 0x10], edi
pop ecx
pop ecx
mov eax, str..fnr
je 0x40116f
mov eax, str..fne
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.004012a0
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x110]
push eax
call ebx
mov edi, eax
inc dword [ebp + 0x10]
test edi, edi
je 0x40107f
test edi, edi
jne 0x4011af
push 0x10
push 0x4050a0
push 0x405068
jmp 0x4011dd
push str.GetLibInterface
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4011ca
push 0x3e8
call eax
test eax, eax
jne 0x4011ea
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x10
push 0x4050a0
push 0x405030
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
or eax, 0xffffffff
jmp 0x401207
push dword [ebp + 0x14]
push esi
push dword [ebp + 8]
push 2
push 0
push 0xc8
call eax
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10