joyce8/EMBER2024-capa huggingface dataset:
Function at 0x661250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x675808
push 0x665288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x661329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x661329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.006641d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x661329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x661329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x66132c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00661351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x661d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x661d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x661d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x661d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x661d94
push eax
push esi
call fcn.0066420b
add esp, 8
pop esi
ret 0x10

Function at 0x661da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x661e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x661e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x67a320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00663dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x661dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x661e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x661ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x661eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x67a320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00663dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x661eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x661e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x662000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x662131
push esi
call fcn.00665145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00654080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x662131
push 0
push ebp
call fcn.006543a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00654260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x66208b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.006542f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x662121
push 0x67a918
push edi
call fcn.006633f0
push eax
push ebx
push esi
call fcn.00661f60
push 0x67a8f8
push edi
call fcn.006633f0
push eax
push ebx
push esi
call fcn.00661f60
push 0x67a8d8
push edi
call fcn.006633f0
push eax
push ebx
push esi
call fcn.00661f60
push 0x67a8c0
push edi
call fcn.006633f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00661f60
push 0x67a8a0
push edi
call fcn.006633f0
push eax
push ebx
push esi
call fcn.00661f60
push 0x67a888
push edi
call fcn.006633f0
push eax
push ebx
push esi
call fcn.00661f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x6631b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00663140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00663140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00663140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00663140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x663bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x663c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x67587c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x663c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x663c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x287a2703
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x4c143802
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x57006a44
Capabilities:
Get geographical location

Disassembly:
push ecx
cmp word [0x5702438c], 0
jne 0x57006a7c
push 2
lea eax, [esp + 4]
push eax
push 0xe
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x57006a73
movzx eax, word [esp]
mov word [0x5702438c], ax
jmp 0x57006a7c
mov word [0x5702438c], 0x2c
movzx eax, word [0x5702438c]
pop edx
ret
Function at 0x57007a24
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
mov edx, esi
call sub.rtl120.bpl__System__LStrAsg_qqrpvpxv
mov eax, ebx
call sub.rtl120.bpl__System_UniqueString_qqrr27System__AnsiStringT_us_i0__
mov eax, dword [ebx]
call sub.rtl120.bpl__System__LStrLen_qqrx27System__AnsiStringT_us_i0__
test eax, eax
jle 0x57007a55
mov edx, 1
mov ecx, dword [ebx]
xor byte [ecx + edx - 1], 0x55
inc edx
dec eax
jne 0x57007a4a
pop esi
pop ebx
ret
Function at 0x5701e4a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, eax
dec ecx
test ecx, ecx
jl 0x5701e4c4
inc ecx
mov eax, edx
mov edx, esi
xor dl, byte [eax]
movzx edx, dl
mov edx, dword [edx*4 + 0x5702518c]
shr esi, 8
xor edx, esi
mov esi, edx
inc eax
dec ecx
jne 0x5701e4ab
mov eax, esi
pop esi
ret
Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x408e3a
Capabilities:
Encode data using xor

Disassembly:
or eax, dword [eax]
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
add byte [ecx], al
and al, 1
test ebx, ebx
je 0x408d58
add byte [0x887bfc], bl
jne 0x408d7d
add byte [ecx], al
add eax, 0x887c00
mov ebx, 0x6feb2400
movzx eax, byte [ebx]
sub al, 0
add dword [esi], eax
dec al
je 0x408d97
scasd eax, dword es:[edi]
add byte [edi], cl
mov dh, 0x43
add dword [ebx], eax
ret
cvtps2pi mm0, qword [eax]
add dword [ebx], eax
cmp dword [esi + 6], 0
add byte [ecx], al
mov ebp, dword [esi + 6]
dec ebp
test dword [ebx + 0x33453d00], esp
inc dword [ebx + 0x100fe7c]
cmp dword [esi + edi*8], 1
je 0x408dec
mov eax, dword [esi + edi*8 + 0x50]
add byte [eax], bl
cmp byte [ebx], 0xd
jne 0x408dd4
sldt word [ecx]
add dword [ebx], eax
ret
cmp byte [ebx], 0xe
jne 0x408e38
add bl, al
call fcn.00408d5a
test byte [eax], al
add dword [eax], ecx
inc edi
dec ebp
jne 0x408dae
inc eax
add byte [eax + eax], ah
movzx eax, byte [esp]
pop edx
add byte [ecx], al
pop esi
pop ebx
ret
fild word [eax]
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
add byte [ecx], al
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x2d], edx
add byte [ebp - 4], al
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add byte [ecx], al
loopne 0x408de0
inc ebp
or byte [ebx + 0x7fdb00d0], cl
sbb eax, dword [ebp + 0x77ddb]
add eax, ebp
add cl, byte [edi + edi*8 - 0x3ffe401]
mov edx, dword [ebp - 8]
call 0x1409226
jmp 0x4090f6
and eax, 0xd1612d32
out dx, al
loope 0x409120
invalid
sbb dl, cl
push ebp
rcl dword [esi + edx*4 + 0x70], 0x5a
xchg esi, eax
xchg esp, eax
mov al, 0x16
adc al, 0x78
xor eax, 0xb865404c
inc eax
in eax, 0x8e
lcall 0xc16e, 0xfc7682ee
add ah, ch
xchg ebp, eax
ret 0x8316

Function at 0x44ba10
Capabilities:
Accept command line arguments
Check os version

Disassembly:
sub esp, 8
mov al, byte [0x662041]
mov cl, byte [0x66204b]
xor cl, al
push ebx
mov byte [0x66204b], cl
mov cl, byte [0x662042]
or cl, 0x10
shr cl, 3
and ecx, 0xff
mov dword [esp + 4], ecx
fild dword [esp + 4]
fdivr qword [0x665968]
fadd qword [0x662058]
fstp qword [0x6659d8]
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dl, byte [0x66204d]
mov ebx, eax
mov al, byte [0x662041]
or al, dl
mov byte [0x662041], al
mov al, byte [0x662045]
or al, 2
shr al, 1
and eax, 0xff
mov dword [esp + 4], eax
fild dword [esp + 4]
fdivr qword [0x662058]
fadd qword [0x65e718]
fstp qword [0x665978]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x44bac9
mov edx, dword [0x665ac4]
push 0x6657dc
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, dword [0x665ac4]
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov ecx, ebx
xor eax, eax
and ecx, 0xff
mov al, bh
cmp ecx, 5
pop ebx
jne 0x44baee
cmp eax, 1
jae 0x44bafe
mov dword [0x664fc8], 0x409
add esp, 8
ret
ja 0x44bafe
mov dword [0x664fc8], 0x409
add esp, 8
ret
mov dword [0x664fc8], 0x7f
add esp, 8
ret
Function at 0x589a82
Capabilities:
Encode data using xor

Disassembly:
fldenv [eax - 0x17]
invalid
adc eax, 0x442d163e
adc al, 0xf8
xor dword [edx + 0x91dea1f], eax
pop esi
cmpsb byte [esi], byte es:[edi]
jle 0x5899a4
sbb eax, 0x7ea65e09
test dword [ebp - 0xc], eax
mov ecx, 0xb27b5ee9
mov ecx, 0x8e985868
shr byte [esi + 0x7475a3ef], cl
and dword [esi - 4], esi
out dx, eax
xchg byte [edx - 1], bl
ficom dword [ecx - 0x40d6c108]
lds esp, [edx + 8]
outsd dx, dword [esi]
loope 0x589a0e
inc ebp
hlt
shr dword [ebx + 0x15], 1
ret 0xdeaf
add edx, ecx
imul ebp, dword [ecx], 0xdc046819
mov byte [edi + 0x50], bl
push eax
jae 0x589a19
iretd

Function at 0x659a0d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6623a8
cmp edx, dword [eax]
je 0x659a2f
add eax, 8
inc ecx
cmp eax, 0x662438
jl 0x659a20
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6623a8]
jne 0x659b5d
mov eax, dword [0xa5cd0c]
cmp eax, 1
je 0x659b37
test eax, eax
jne 0x659a60
cmp dword [0x6622d4], 1
je 0x659b37
cmp edx, 0xfc
je 0x659b5d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x659a97
lea eax, [ebp - 0x1a4]
push 0x65eab0
push eax
call fcn.0065a3f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a880
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x659ada
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a880
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65eaac
push edi
call fcn.0065c750
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65ea90
push eax
call fcn.0065a3f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a400
lea eax, [ebp - 0xa0]
push 0x65ea8c
push eax
call fcn.0065a400
push dword [esi + 0x6623ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a400
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65ea64
push eax
call fcn.0065c6c4
add esp, 0x2c
pop edi
jmp 0x659b5d
lea eax, [ebp + 8]
lea esi, [esi + 0x6623ac]
push 0
push eax
push dword [esi]
call fcn.0065a880
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4023c0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x402868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov eax, dword [esp + 0x18]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x402439
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 4]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov al, 1
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 8]
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x402460
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x402890
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
and ecx, 0xffff
push eax
push ecx
push 0
mov dword [esp + 0x24], 1
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x402509
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x402509
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x402509
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, ebx
mov esi, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call sub.MFC42.DLL_CString::CString
call fcn.004023c0
add esp, 0xc
test al, al
push ebp
jne 0x40253d
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 0
call fcn.00402600
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402600
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov al, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x1003f3e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x8c
mov eax, dword [0x10059d10]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0x90]
push ebx
mov ebx, dword [esp + 0x9c]
push esi
push edi
mov edi, dword [esp + 0xa0]
mov esi, 0x80
mov dword [esp + 0xc], eax
test edi, edi
jns 0x1003f423
lea edi, [esi - 0x7f]
mov ebx, 0x10050258
jmp 0x1003f428
cmp edi, esi
cmovg edi, esi
mov ecx, dword [esp + 0xa8]
mov eax, 0x400
test ecx, ecx
push ebp
cmove ecx, eax
push edi
push ebx
push edi
lea eax, [ecx + 7]
cdq
and edx, 7
lea ebp, [edx + eax]
mov eax, 0xff
sar ebp, 3
lea edx, [ebp*8]
sub ecx, edx
add ecx, 8
shl eax, cl
not eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.MSVCR120.dll_memcpy_s]
add esp, 0x10
cmp edi, esi
jge 0x1003f4a1
mov ebx, 1
lea eax, [esp + edi + 0x17]
sub ebx, edi
sub esi, edi
movzx ecx, byte [ebx + eax]
lea edx, [eax + 1]
movzx eax, byte [eax]
add ecx, eax
and ecx, 0xff
mov al, byte [ecx + 0x10050158]
mov byte [edx], al
lea eax, [edx]
dec esi
jne 0x1003f482
lea ecx, [esp + 0x98]
mov edx, 0x7f
sub ecx, ebp
movzx eax, byte [ecx]
and eax, dword [esp + 0x14]
sub edx, ebp
mov al, byte [eax + 0x10050158]
mov byte [ecx], al
js 0x1003f4de
lea eax, [edx + ebp]
movzx ecx, byte [esp + eax + 0x18]
movzx eax, byte [esp + edx + 0x19]
xor ecx, eax
mov al, byte [ecx + 0x10050158]
mov byte [esp + edx + 0x18], al
dec edx
jns 0x1003f4c2
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x18]
mov edi, 0x10
pop ebp
lea esi, [ebx + 8]
nop
movzx edx, byte [eax + 1]
lea esi, [esi + 0x10]
movzx ecx, byte [eax]
lea eax, [eax + 8]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 6]
mov dword [esi - 0x18], edx
movzx edx, byte [eax - 5]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 4]
mov dword [esi - 0x14], edx
movzx edx, byte [eax - 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 2]
mov dword [esi - 0x10], edx
movzx edx, byte [eax - 1]
shl edx, 8
or edx, ecx
mov dword [esi - 0xc], edx
dec edi
jne 0x1003f4f0
mov ecx, dword [esp + 0x94]
mov dword [ebx + 0x100], edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100415f0
add esp, 0x8c
ret
Function at 0x401460
Capabilities:
Set registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x444e3c]
xor eax, esp
mov dword [esp + 0x20c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
shl ecx, 0x10
xor ecx, eax
and ecx, 0x3fffffff
mov dword [esp + 4], ecx
ja 0x401495
mov dword [esp + 4], 0x18705
push 0x1ff
lea edx, [esp + 0x11]
push 0
push edx
mov byte [esp + 0x18], 0
call fcn.00421410
add esp, 0xc
push str.RegPath_VHLD
call fcn.004139e0
mov ecx, eax
call fcn.004136d0
push eax
lea eax, [esp + 0x10]
push str.Software_sMACHINE_ID
push eax
call fcn.00420f5a
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 4]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40151e
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004213c3
add esp, 0x210
ret
mov eax, dword [esp]
push 4
lea edx, [esp + 8]
push edx
push 4
push 0
push str.MACHINE_ID
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4014fd
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20c]
mov eax, dword [esp + 4]
xor ecx, esp
call fcn.004213c3
add esp, 0x210
ret