joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bf10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x41e960
lea ecx, [ebp - 0x18]
mov edx, dword fs:[0]
cmp eax, 3
mov dword [ebp - 0x18], edx
mov dword fs:[0], ecx
je 0x41bf4e
test eax, eax
jne 0x41c0ca
mov ebx, dword [0x449a28]
test ebx, ebx
je 0x41c0ca
mov dword [ebp - 0x20], 0
jmp 0x41bf77
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41bfa8
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41c11b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41bf70
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x41bf70
test byte [ebp - 0x20], 1
je 0x41c0ca
mov ebx, dword [0x449a28]
test ebx, ebx
je 0x41c0ca
mov dword [ebp - 0x20], 0
jmp 0x41bfd7
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41c008
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41c11b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41bfd0
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x41bfd0
test byte [ebp - 0x20], 1
je 0x41c0ca
mov ebx, dword [0x449a28]
test ebx, ebx
je 0x41c0ca
mov dword [ebp - 0x20], 0
jmp 0x41c037
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41c068
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41c11b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41c030
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x41c030
test byte [ebp - 0x20], 1
je 0x41c0ca
mov ebx, dword [0x449a28]
test ebx, ebx
je 0x41c0ca
mov dword [ebp - 0x20], 0
jmp 0x41c097
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41c0c4
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41c11b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41c090
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
mov al, 1
mov dword [ebp - 0x20], eax
jmp 0x41c090
test byte [ebp - 0x20], 1
jne 0x41c0e4
movzx eax, byte [0x445200]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov ebx, dword [0x449a28]
jmp 0x41c0ef
mov ebx, dword [ebx + 8]
test ebx, ebx
je 0x41c0ca
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
test edi, edi
je 0x41c11b
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41c0ec
push 0
push esi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push esi
call edi
add esp, 4
jmp 0x41c0ec
mov dword [ebp - 0x10], 0
push 0x43dff8
push 0x2b
push str.called__Option::unwrap____on_a__None__value_rustc_90c541806f23a127002de5b4038be731ba1458calibrary_alloc_srccollections_btreemapentry.rs
call fcn.00439dd0
add esp, 0xc
ud2
Function at 0x41d700
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x41ea00
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [0x449058]
test eax, eax
je 0x41d754
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x41d76d
cmp dword [eax], 0
mov ebx, eax
je 0x41d76d
add ebx, 4
jmp 0x41d842
push 0x449058
call fcn.00439600
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x41d745
mov eax, dword [0x449058]
test eax, eax
je 0x41d823
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41d840
mov edi, eax
test eax, eax
jne 0x41d7de
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0x449058
push 4
push 0x10
call fcn.00402a10
add esp, 8
test eax, eax
je 0x41d867
movsd xmm0, qword [ebp - 0x2c]
movsd xmm1, qword [ebp - 0x24]
mov edi, eax
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov eax, dword [0x449058]
test eax, eax
je 0x41d855
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x41d7f8
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
mov edx, eax
je 0x41d7fc
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x41d7fc
xor eax, eax
xor edx, edx
mov ecx, dword [edi + 8]
cmp dword [edi], 0
lea ebx, [edi + 4]
mov dword [edi], 1
mov dword [edi + 4], eax
mov dword [edi + 8], edx
je 0x41d842
test ecx, ecx
je 0x41d842
lock dec dword [ecx]
jne 0x41d842
call fcn.00408000
jmp 0x41d842
push 0x449058
call fcn.00439600
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x41d78b
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ebx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x449058
call fcn.00439600
add esp, 4
jmp 0x41d7d6
mov dword [ebp - 0x10], 0
push 4
push 0x10
call fcn.00439c90
add esp, 8
ud2
Function at 0x41d8f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x449068]
mov esi, ecx
test eax, eax
je 0x41d915
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jbe 0x41d92e
cmp dword [eax], 0
je 0x41d92e
add eax, 4
pop esi
pop edi
ret
push 0x449068
call fcn.00439600
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
ja 0x41d90a
mov eax, dword [0x449068]
test eax, eax
je 0x41d9a1
dec eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
je 0x41d9ba
mov edi, eax
test eax, eax
jne 0x41d97b
push 4
push 0xc
call fcn.00402a10
add esp, 8
test eax, eax
je 0x41d9ce
mov dword [eax], 0
mov dword [eax + 8], 0x449068
mov edi, eax
mov eax, dword [0x449068]
test eax, eax
je 0x41d9bf
dec eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x41d990
mov ecx, dword [esi]
mov dword [esi], 0
test ecx, ecx
je 0x41d992
mov ecx, dword [esi + 4]
jmp 0x41d992
xor ecx, ecx
mov dword [edi], 1
lea eax, [edi + 4]
mov dword [edi + 4], ecx
pop esi
pop edi
ret
push 0x449068
call fcn.00439600
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, 1
jne 0x41d944
xor eax, eax
pop esi
pop edi
ret
push 0x449068
call fcn.00439600
add esp, 4
jmp 0x41d973
push 4
push 0xc
call fcn.00439c90
add esp, 8
ud2
Function at 0x429770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4297c8
mov esi, dword [esp + 0x18]
lea edi, [edx + eax*2]
xor ebx, ebx
movzx eax, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea ebp, [ebx + eax]
jne 0x4297c0
cmp ebp, ebx
jb 0x429842
cmp ebp, dword [esp + 0x1c]
ja 0x429853
add ebx, esi
nop word [eax + eax]
test eax, eax
je 0x4297c2
dec eax
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x4297b0
jmp 0x42981f
ja 0x4297c8
cmp edx, edi
mov ebx, ebp
jne 0x429785
mov edx, dword [esp + 0x24]
test edx, edx
je 0x429823
mov esi, dword [esp + 0x20]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax + eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x429800
mov esi, edi
sub ecx, ebx
jns 0x429817
jmp 0x429825
cmp edi, edx
je 0x42982c
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x429825
xor al, 1
cmp esi, edx
jne 0x4297e0
jmp 0x429825
xor eax, eax
jmp 0x429825
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x43fa50
push 0x2b
push str.called__Option::unwrap____on_a__None__value
call fcn.00439dd0
add esp, 0xc
ud2
push 0x43fa40
push ebp
push ebx
call fcn.0043a130
add esp, 0xc
ud2
push 0x43fa40
push dword [esp + 0x20]
push ebp
call fcn.0043a110
add esp, 0xc
ud2

Function at 0x42b137
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42b176
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42b176
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42b176
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42b176
cmp dword [ecx + 0x74], 0xe
jbe 0x42b176
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4323d3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x432470
push ebx
push esi
call fcn.0043239c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00432330
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x43241d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43246f
push edi
push eax
call fcn.00432ff0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x43243d
call fcn.00430e91
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43246e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00432330
add esp, 0x20
test eax, eax
jne 0x43245c
push edi
call fcn.00430e91
jmp 0x432464
push ebx
call fcn.00430e91
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x43376d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4423d0
push 0x4423c8
push str.FlsAlloc
push 0x1f
call fcn.0043362c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4337a1
push dword [ebp + 8]
mov ecx, esi
call dword [0x43b1dc]
call esi
jmp 0x4337a7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4337eb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4423e0
push 0x4423d8
push str.FlsGetValue
push 0x21
call fcn.0043362c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x433822
push dword [ebp + 8]
mov ecx, esi
call dword [0x43b1dc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x43382a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4423e8
push 0x4423e0
push str.FlsSetValue
push 0x22
call fcn.0043362c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x433864
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x43b1dc]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x438cc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x438ced
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x438ced
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x439600
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
cmp dword [edi + 4], 0
je 0x43967a
lea ebx, [edi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x4396b5
cmp dword [esp + 4], 0
je 0x43969c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4396d8
mov esi, eax
inc eax
mov dword [edi], eax
mov eax, dword [0x449a28]
nop word [eax + eax]
mov dword [edi + 8], eax
lock cmpxchg dword [0x449a28], edi
jne 0x439660
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
jmp 0x4396ac
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x43971f
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
jne 0x4396a0
mov esi, dword [esp]
jmp 0x4396ac
mov esi, dword [edi]
jmp 0x4396ab
mov esi, eax
push dword [esp]
call dword [sym.imp.KERNEL32.dll_TlsFree]
dec esi
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov dword [esp + 0x10], 0
lea eax, [esp + 8]
mov ecx, esp
mov edx, 0x43df74
push 0x43dfa8
push eax
call fcn.00439100
add esp, 8
ud2
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
mov dword [esp + 0x10], 0x43dfcc
mov dword [esp + 0x14], 1
mov dword [esp + 8], 0
mov dword [esp + 0x18], 0x43ba78
mov dword [esp + 0x1c], 0
lea eax, [esp + 8]
push 0x43dfd4
push eax
call fcn.00439d10
add esp, 8
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0x43dfcc
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0x43ba78
mov dword [esp + 0x1c], 0
call fcn.00439040
ud2
Function at 0x401184
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
sub esp, 0x2a8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x2a4], eax
push ebx
push ebp
push esi
xor ebp, ebp
push ebp
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x40134f
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x22c
push eax
push esi
mov ebx, ebp
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x4011e9
push str.explorer.exe
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4011ef
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4011c9
jmp 0x4011fe
push dword [esp + 0x28]
push ebp
push 0x2a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x40134f
push edi
mov edi, dword [0x4031e4]
push 0x40
push 0x3000
push dword [edi + 0x4031f8]
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push ebp
push dword [edi + 0x4031fc]
mov dword [esp + 0x18], eax
push 0x4031a8
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor eax, eax
cmp ax, word [edi + 0x4031ae]
jae 0x40127d
lea esi, [edi + 0x4032b4]
mov eax, dword [esi]
push 0
push dword [esi - 4]
add eax, 0x4031a8
push eax
mov eax, dword [esi - 8]
add eax, dword [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx eax, word [edi + 0x4031ae]
lea esi, [esi + 0x28]
inc ebp
cmp ebp, eax
jl 0x401252
push 0x20
push 0x3000
push 0x1000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov ebp, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlZeroMemory
push 0x403164
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call esi
push 0
push 0x10
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
mov ecx, 0x401036
lea esi, [edi + 0x10]
mov eax, fcn.00401181
sub eax, ecx
push eax
push ecx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0xffffffffffffffff
xor eax, eax
push eax
push eax
push edi
push esi
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push ebp
push str.explorer.exe
push str.Dll_successfully_loaded_into__ws_at_0x_x
lea eax, [esp + 0x25c]
push 0x64
push eax
call fcn.00401006
add esp, 0x14
lea eax, [esp + 0x250]
push 0x40
push str.Success
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
mov ecx, dword [esp + 0x2b0]
xor eax, eax
pop esi
pop ebp
pop ebx
xor ecx, esp
inc eax
call fcn.0040136c
add esp, 0x2a8
ret 0x10
Function at 0x401b94
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401bd3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401bd3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401bd3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401bd3
cmp dword [ecx + 0x74], 0xe
jbe 0x401bd3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..idata
mov ebx, 0x408ecc
nop
mov ecx, 0x3c2613ad
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x1b616e30
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x100027a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x100027b7
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100027e8
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x100027e4
cmp esi, eax
jae 0x100027e8
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x100027d4
cmp esi, eax
jb 0x100027ee
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x10002f10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x1003f1b0]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [0x10041498]
test eax, eax
jne 0x10002fd4
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.1000e5c0
add esp, 0xc
push str.BApi.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10002f69
push 0x104
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp word [esp + 8], 0
jne 0x10002fbd
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 8]
push edx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0x207
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.deepscan_bapi.dll
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push esi
call fcn.10001420
mov esi, eax
lea eax, [esp + 0xc]
call fcn.10002d10
mov dword [0x10041498], eax
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.1000d18f
add esp, 0x214
ret
Function at 0x100032d0
Capabilities:
Find taskbar
Get common file path

Disassembly:
sub esp, 0x218
mov eax, dword [0x1003f1b0]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push ebp
push esi
push edi
xor esi, esi
push 0x208
lea eax, [esp + 0x20]
push esi
push eax
mov dword [esp + 0x1c], esi
call fcn.1000e5c0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.Wtsapi32.dll
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebp, ebp
mov dword [esp + 0x18], eax
cmp eax, esi
je 0x10003344
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, eax
mov ebx, dword [sym.imp.USER32.dll_FindWindowW]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test ebp, ebp
je 0x1000336b
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0xffffffff
je 0x1000336b
lea ecx, [esp + 0x10]
push ecx
push eax
call ebp
test eax, eax
jne 0x100033c8
push 0
push str.Shell_TrayWnd
call ebx
test eax, eax
jne 0x10003387
push 0x2710
inc esi
call edi
cmp esi, 0x1e
jb 0x10003350
jmp 0x100033c8
lea edx, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x1c], 0xffffffff
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x14]
push eax
push 0
push 0x80000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100033c8
lea ecx, [esp + 0x10]
push ecx
push 0xb
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
je 0x100033db
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x214]
mov eax, dword [esp]
xor ecx, esp
call fcn.1000d18f
add esp, 0x218
ret
Function at 0x100040e0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x1001c175
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x1003f1b0]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, ecx
push 0x10041708
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x10], 0
mov eax, dword [0x10041490]
test eax, eax
jne 0x10004129
call fcn.10001420
mov dword [0x10041490], eax
cmp dword [eax + 0x11c], 0
je 0x1000414c
mov eax, dword [eax + 0x110]
test eax, eax
je 0x1000414c
push esi
push edi
push 2
push 0
push str.ServiceDll
push ebx
call eax
jmp 0x1000415e
push esi
push edi
push 2
push 0
push str.ServiceDll
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x10041708
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret

Function at 0x10004370
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100043de
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x100043af
cmp eax, 2
jne 0x100043ca
mov eax, dword [esp]
test esi, esi
je 0x100043d8
test eax, eax
je 0x100043d3
test al, 1
jne 0x100043ca
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x100043d8
mov eax, 0xd
pop ecx
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8