joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ef70
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45f11b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x45f0fc
mov dl, 1
mov eax, dword [0x417990]
call fcn.00404180
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004050b0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x45f0eb
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004506c4
test al, al
je 0x45f0de
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x45f12c
lea eax, [ebp - 0x254]
call fcn.0040ac68
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45f0de
xor eax, eax
push ebp
push 0x45f0d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45f164
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45f0c0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00405320
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45f0c0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00405320
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f0de
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45efe1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.0041c308
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f122
lea eax, [ebp - 0x260]
call fcn.004050b0
ret

Function at 0x45fa94
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x49dc9c]
cmp byte [eax + 0xad], 0
jne 0x45fb05
cmp dword [0x49dcb8], 0
jne 0x45fac6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45fa50
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x49dcb8], eax
cmp dword [0x49dcb4], 0
jne 0x45fae1
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x49dcb4], eax
cmp dword [0x49dcbc], 0
jne 0x45fb05
push esp
push 0
push 0
push 0x45f9f4
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x49dcbc], eax
pop edx
ret
Function at 0x45fd08
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45fd1f
add esp, 0xfffffff0
call fcn.004044d4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00420bc4
mov eax, dword [0x498b10]
cmp word [eax + 2], 0
jne 0x45fd47
mov eax, dword [0x498b10]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00461a10
mov eax, dword [0x498c28]
cmp word [eax + 2], 0
jne 0x45fd61
mov eax, dword [0x498c28]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00461c1c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x417324]
call fcn.00404180
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x417324]
call fcn.00404180
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x417324]
call fcn.00404180
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x425270]
call fcn.0042ce7c
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x45ff18
mov eax, dword [0x4989a8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042d250
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4622e0
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4989a8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ea28
test eax, eax
je 0x45fe68
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040a284
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ea5c
test eax, eax
je 0x45fe7c
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00405320
mov byte [ebx + 0xd4], 0
push ebx
push 0x461484
call fcn.00421d40
mov dword [ebx + 0xc8], eax
mov eax, dword [0x4987b0]
cmp byte [eax], 0
jne 0x45fecd
mov eax, ebx
call fcn.0046005c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004624f4
mov eax, ebx
call fcn.00463058
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45ff0d
call fcn.0040452c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4602dc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x46037b
cmp dword [ebx + 0x94], 0
jne 0x460375
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x460264
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x460375
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46033b
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x460375
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004199f4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46034a
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x460594
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x49dc9c]
cmp dword [eax + 0x30], 0
je 0x4606f1
test bl, bl
jne 0x460642
cmp dword [esi + 0x9c], 0
jne 0x460637
mov eax, esi
call fcn.00462ed4
push eax
push 0x4604c0
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x460608
mov eax, dword [0x49dc9c]
call fcn.004635b4
test al, al
je 0x460608
mov eax, dword [0x49dcc0]
call fcn.0040636c
mov edi, eax
cmp edi, 0
jl 0x460608
push 0
mov eax, dword [0x49dcc0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4605f2
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x460637
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.004199f4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x460617
inc dword [esi + 0x9c]
jmp 0x4606f1
cmp dword [esi + 0x9c], 0
jle 0x4606f1
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4606f1
cmp dword [esi + 0x44], 0
je 0x46069d
mov eax, dword [0x49dc9c]
call fcn.004635b4
test al, al
je 0x46069d
mov eax, dword [0x49dcc0]
call fcn.0040636c
mov edi, eax
cmp edi, 0
jl 0x46069d
push 5
mov eax, dword [0x49dcc0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x460687
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4606cc
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.004199f4
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4606ac
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x49dcc0
mov ecx, 1
mov edx, dword [0x4604a0]
call fcn.00406520
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4611d8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x461242
mov eax, ebx
call fcn.004635b4
test al, al
jne 0x461242
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004051a0
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x46122f
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x46124f
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405104
jmp 0x46124f
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405104
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x4626d8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x462746
mov eax, esi
call fcn.0044b2f4
test al, al
je 0x462746
mov eax, dword [ebx + 0x84]
call fcn.0044af54
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x462746
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x46273a
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044af54
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00442d8c
jmp 0x462746
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00462514
pop esi
pop ebx
ret
Function at 0x463f50
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x407fc8]
call fcn.00405b40
xor eax, eax
push ebp
push 0x4640f1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x497884], 0
jne 0x463fab
mov ecx, dword [0x4987d4]
mov dl, 1
mov eax, dword [0x4085d4]
call fcn.0040dbe4
call fcn.00404a24
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403978
mov eax, ebx
call fcn.004059f0
mov dword [ebp - 0x24], eax
mov esi, 0x464100
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00406c10
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405a00
test eax, eax
jle 0x464094
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x464080
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405320
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x464026
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00405338
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x46403c
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00405338
mov eax, dword [ebp - 0x54]
call fcn.00405540
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405320
mov eax, dword [ebp - 0x58]
call fcn.00405540
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x464082
xor eax, eax
test al, al
je 0x46408d
mov ebx, 0x15
jmp 0x464099
mov ebx, 0x10
jmp 0x464099
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x497884]
call fcn.00463dd0
mov eax, dword [ebp - 4]
call fcn.00463dd0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00406c28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4640f8
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.004050d4
lea eax, [ebp - 0xc]
mov edx, dword [0x407fc8]
call fcn.00405c10
ret

Function at 0x489a30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x489a8a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00489a20
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00487310
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00486e28
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489a91
lea eax, [ebp - 4]
call fcn.004050b0
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x403e59
pop dword [ebp - 0x2c]
mov eax, 0x1f1c144a
add eax, 0xe1242a0f
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x7ed39c99
sub dword [ebp - 0x3c], 0x3081574e
mov dword [ebp - 0x38], 0xcce13f57
add dword [ebp - 0x38], 0x65520cee
mov dword [ebp - 0x34], 0xc043ea4a
add dword [ebp - 0x34], 0x8c0859e4
mov dword [ebp - 0x30], 0x6ba7645b
sub dword [ebp - 0x30], 0x6ba7645b
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xe9058492
add dword [ebp - 0x3c], 0x8b6ce4c4
mov dword [ebp - 0x38], 0xedd0cb0b
add dword [ebp - 0x38], 0x539b966a
mov dword [ebp - 0x34], 0x2d1e3a2e
sub dword [ebp - 0x34], 0xc9aecdc2
mov dword [ebp - 0x30], 0xebf21253
sub dword [ebp - 0x30], 0xebf21253
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xfc9015eb
sub eax, 0xfc4f9517
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x34bb5
push 0
call eax
mov ecx, 0xd7ad277a
add ecx, 0x28531876
xor edi, edi
add edi, eax
mov ebx, 0x411000
add ebx, dword [ebp - 0x2c]
mov edx, 0x2cc1bb8
sub edx, 0xbdfcbebf
sub dword [ebp - 4], 0xa16d5b8
mov esi, dword [ebx]
xor dword [ebp - 4], ebx
add esi, edx
mov dword [edi], esi
xor dword [ebp - 8], 0x969c4b58
add edi, 0xa0cfb9f7
sub edi, 0xa0cfb9f3
add ebx, 0xbd8b3a4
sub ebx, 0xbd8b3a0
loop 0x403f72
add eax, 0x4914188e
sub eax, 0x491325fb
mov ebx, eax
add eax, 0xcad54059
sub eax, 0xcad54054
mov ecx, 0x6bad73d6
sub ecx, 0x6b6d73d6
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x1f875f33
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x6b84756
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x9a2cf8
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x9a2cfe
pop ebp
sub ebp, 6
sub ebp, 0x5a2cf8
jmp 0x9a2d5c
jmp 0x9a2d65
mov eax, 0x5a2cf8
add eax, ebp
add eax, 0x93
mov ecx, 0x5cb
mov edx, 0x4f6f790b
xor byte [eax], dl
inc eax
dec ecx
jne 0x9a2d7c
jmp 0x9a2d8f
add dh, 0x80
xor byte [edi], 0xb
or ecx, dword [ebx]
mov cl, dl
or ecx, dword [ebx]
or ecx, dword [eax]
invalid

Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x42229c
push eax
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
or al, 0xfe
cli
mov byte [edi + 0x24735128], bh
sub al, 0x1f
pop ds
sbb cl, byte [edi]
xor dword [edi + 0x1b9418a9], ebx
dec edx
shl byte [ecx - 0x2a], cl
out dx, eax
lea esp, [ebx + 0x1326901b]
test cl, ah
cwde
xlatb
dec edx
cmp byte [eax - 0x44e4c50d], dl
xor cl, bl
aam 2
inc ebx
cmc
neg byte [esi - 0x5a]
inc ecx
rol dword [edi], cl
nop
mov dh, 0x9a
insd dword es:[edi], dx
leave
cmc
cld
test dword [eax], edi
sbb edi, dword [ebp - 0x21]
add eax, 0x2bb180b2
mov ebx, 0x136b26fc
push ss
jmp 0x40102e
invalid
Function at 0x407f80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x509d20
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x567680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx ecx, word [ebp + 0x10]
push ecx
movzx ecx, word [ebp + 0xc]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ecx, [ebx + 1]
push ecx
mov esi, eax
call fcn.004e8060
push ebx
mov edi, eax
push esi
push edi
call fcn.004e9970
add esp, 0x10
lea ecx, [ebp - 0x10]
push edi
mov byte [edi + ebx], 0
call fcn.00401a70
push edi
mov dword [ebp - 4], 0
call fcn.004e8ec3
mov eax, dword [0x5671f0]
mov edi, dword [ebp - 0x10]
add esp, 4
mov ecx, 0x5671f0
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 1
test edi, edi
je 0x408061
test edi, 0xffff0000
jne 0x408061
movzx edi, di
push 0
push edi
call fcn.00403090
add esp, 8
test eax, eax
je 0x408069
push edi
push eax
mov ecx, esi
call fcn.004082e0
jmp 0x408069
push edi
mov ecx, esi
call fcn.004027d0
mov edi, dword [ebp - 0x10]
add edi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40808d
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40bce0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40bcf5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40bd34
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40bd30
lea ebx, [ebx]
cmp esi, edx
jae 0x40bd34
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x40bd20
cmp esi, edx
jb 0x40bd39
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x40e400
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
mov dword [edi], 0
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e471
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x40e43f
cmp eax, 2
jne 0x40e45b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x40e46b
test ecx, ecx
je 0x40e466
test cl, 1
jne 0x40e45b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x40e46b
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
mov dword [edi], ecx
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x40fa50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x40fa65
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
jmp 0x40fa70
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40fa70
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x4101d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
call fcn.004103d0
mov ebx, dword [ebp + 8]
add esp, 4
mov dword [ebp - 4], eax
test ebx, ebx
je 0x41037b
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x41037b
cmp eax, dword [ebp + 0x14]
ja 0x41037b
xor ecx, ecx
test esi, esi
je 0x410294
cmp ecx, esi
jae 0x41021c
movzx edx, byte [ecx + ebx]
inc ecx
jmp 0x41021e
xor edx, edx
cmp ecx, esi
jae 0x41022c
movzx eax, byte [ecx + ebx]
mov dword [ebp + 8], eax
inc ecx
jmp 0x410233
mov dword [ebp + 8], 0
cmp ecx, esi
jae 0x41023e
movzx eax, byte [ecx + ebx]
inc ecx
jmp 0x410240
xor eax, eax
shl edx, 8
add edx, dword [ebp + 8]
add edi, 4
shl edx, 8
add edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi - 4], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi - 3], al
mov eax, edx
shr eax, 6
and eax, 0x3f
and edx, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi - 2], al
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi - 1], al
cmp ecx, esi
jb 0x410215
mov edi, dword [ebp + 0x10]
mov eax, 0xaaaaaaab
mul esi
shr edx, 1
xor ecx, ecx
lea eax, [edx + edx*2]
mov edx, dword [ebp - 4]
sub esi, eax
cmp dword [esi*4 + 0x51a728], ecx
jle 0x4102c5
lea eax, [edx - 1]
add eax, edi
mov byte [eax], 0x3d
inc ecx
lea eax, [eax - 1]
cmp ecx, dword [esi*4 + 0x51a728]
jl 0x4102b5
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
call fcn.00410470
test al, al
jne 0x410372
mov esi, dword [0x568ad4]
mov eax, esi
cdq
sub eax, edx
xor ecx, ecx
mov ebx, eax
sar ebx, 1
mov edi, 0xcd
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], ebx
test ebx, ebx
jle 0x41036a
mov eax, esi
cdq
and edx, 3
add eax, edx
sar eax, 2
xor ecx, ecx
mov dword [ebp + 8], eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ebx
lea ecx, [ecx]
xor edx, edx
xor esi, esi
xor ebx, ebx
cmp eax, 2
jl 0x410341
mov eax, ecx
mov ecx, dword [ebp + 8]
add ecx, 0xfffffffe
shr ecx, 1
inc ecx
lea ebx, [ecx + ecx]
lea esp, [esp]
dec esi
add edx, eax
add esi, eax
sub eax, 2
dec ecx
jne 0x410330
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
cmp ebx, eax
jge 0x41034b
mov eax, ecx
sub eax, ebx
add edi, eax
add ecx, dword [ebp - 4]
lea eax, [esi + edx]
add edi, eax
dec dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 8], ecx
jne 0x410310
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x10]
mov esi, dword [0x568ad4]
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, edi
jl 0x4102f3
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret