joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf308c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0xb], 0x63
mov byte [ebp - 0xa], 0x6f
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x6d
mov byte [ebp - 7], 0
mov byte [ebp - 0x18], 0x5c
mov byte [ebp - 0x17], 0x44
mov byte [ebp - 0x16], 0x69
mov byte [ebp - 0x15], 0x6e
mov byte [ebp - 0x14], 0x6b
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x79
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x24], 0x5c
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0x64
mov byte [ebp - 0x21], 0x70
mov byte [ebp - 0x20], 0x72
mov byte [ebp - 0x1f], 0x6f
mov byte [ebp - 0x1e], 0x2e
mov byte [ebp - 0x1d], 0x69
mov byte [ebp - 0x1c], 0x6e
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0
cmp dword [ebp + 0x18], 0
je 0xf30951
mov dword [ebp - 4], 0x23
jmp 0xf30958
mov dword [ebp - 4], 0x1a
cmp dword [0xf47a04], 0
je 0xf30a34
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0
call dword [0xf47a04]
test eax, eax
jne 0xf30a34
mov edx, dword [ebp + 8]
push edx
call fcn.00f1ac7b
add esp, 4
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax - 1]
cmp edx, 0x5c
je 0xf309ab
push 0xf183e8
mov eax, dword [ebp + 8]
push eax
call fcn.00f1aa26
add esp, 8
cmp dword [ebp + 0xc], 0
je 0xf30a00
cmp dword [ebp + 0x10], 0
je 0xf30a00
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00f1a9e1
add esp, 8
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00f1aa26
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00f1a9e1
add esp, 8
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.00f1aa26
add esp, 8
mov eax, dword [ebp + 0x14]
mov dword [eax], 1
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00f1aa26
add esp, 8
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00f1aa26
add esp, 8
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00f1aa26
add esp, 8
xor eax, eax
jmp 0xf30a8b
push 0x100
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA_1]
test eax, eax
je 0xf30a86
push 0x5c
mov edx, dword [ebp + 8]
push edx
call fcn.00f2fcfc
add esp, 8
test eax, eax
je 0xf30a86
lea eax, [ebp - 0x24]
push eax
push 0x5c
mov ecx, dword [ebp + 8]
push ecx
call fcn.00f2fcfc
add esp, 8
add eax, 1
push eax
call fcn.00f1a9e1
add esp, 8
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
xor eax, eax
jmp 0xf30a8b
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0xf30a8f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov byte [ebp - 0x110], 0
mov al, byte [ebp - 0x110]
mov byte [ebp - 0x104], al
mov cl, byte [ebp - 0x104]
mov byte [ebp - 0x128], cl
xor edx, edx
cmp dword [ebp + 8], 1
sete dl
push edx
lea eax, [ebp - 0x114]
push eax
push 0
push 0
lea ecx, [ebp - 0x100]
push ecx
call fcn.00f308c8
add esp, 0x14
test eax, eax
jne 0xf30b7b
cmp dword [ebp + 8], 1
jne 0xf30b33
lea edx, [ebp - 0x100]
push edx
push 6
lea eax, [ebp - 0x128]
push eax
push 0xf183ec
push 0xf183f4
push 0xf17219
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x100]
push ecx
push 4
lea edx, [ebp - 0x104]
push edx
push 0xf183fc
push 0xf18400
push 0xf17219
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp dword [ebp + 8], 2
jne 0xf30b7b
mov eax, dword [0xf139f5]
push eax
push 0xf18408
lea ecx, [ebp - 0x120]
push ecx
call dword [fcn.00f47970]
add esp, 0xc
lea edx, [ebp - 0x100]
push edx
push 9
lea eax, [ebp - 0x110]
push eax
push 0xf1840c
lea ecx, [ebp - 0x120]
push ecx
push 0xf17219
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp dword [ebp + 8], 1
jne 0xf30bc3
push 3
push 0xf18410
lea edx, [ebp - 0x128]
push edx
call fcn.00f2e346
add esp, 0xc
test eax, eax
jne 0xf30ba2
mov byte [0xf14f66], 1
push 2
push 0xf18414
lea eax, [ebp - 0x104]
push eax
call fcn.00f2e346
add esp, 0xc
test eax, eax
jne 0xf30bc3
mov byte [0xf14f67], 1
cmp dword [ebp + 8], 2
jne 0xf30c54
movsx ecx, byte [ebp - 0x110]
test ecx, ecx
je 0xf30c54
movsx edx, byte [ebp - 0x110]
sub edx, 0x30
imul edx, edx, 0xa
movsx eax, byte [ebp - 0x10f]
lea ecx, [edx + eax - 0x30]
mov byte [0xf16dd6], cl
movsx edx, byte [ebp - 0x10e]
sub edx, 0x30
imul edx, edx, 0xa
movsx eax, byte [ebp - 0x10d]
lea ecx, [edx + eax - 0x30]
mov byte [0xf16dd7], cl
movsx edx, byte [ebp - 0x10c]
sub edx, 0x30
imul edx, edx, 0x3e8
movsx eax, byte [ebp - 0x10b]
sub eax, 0x30
imul eax, eax, 0x64
add edx, eax
movsx ecx, byte [ebp - 0x10a]
sub ecx, 0x30
imul ecx, ecx, 0xa
add edx, ecx
movsx eax, byte [ebp - 0x109]
lea ecx, [edx + eax - 0x30]
mov word [0xf16dd8], cx
mov esp, ebp
pop ebp
ret
Function at 0xf30c58
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
cmp dword [ebp + 8], 1
jne 0xf30cd1
movsx eax, byte [0xf14f66]
test eax, eax
je 0xf30c88
push 0xf18418
lea ecx, [ebp - 0x324]
push ecx
call fcn.00f1a9e1
add esp, 8
jmp 0xf30c9c
push 0xf1841c
lea edx, [ebp - 0x324]
push edx
call fcn.00f1a9e1
add esp, 8
movsx eax, byte [0xf14f67]
test eax, eax
je 0xf30cbd
push 0xf18424
lea ecx, [ebp - 0x304]
push ecx
call fcn.00f1a9e1
add esp, 8
jmp 0xf30cd1
push 0xf18428
lea edx, [ebp - 0x304]
push edx
call fcn.00f1a9e1
add esp, 8
cmp dword [ebp + 8], 2
jne 0xf30d1f
mov eax, dword [0xf139f5]
push eax
push 0xf1842c
lea ecx, [ebp - 0x31c]
push ecx
call dword [fcn.00f47970]
add esp, 0xc
movsx edx, word [0xf14f64]
push edx
movsx eax, byte [0xf14f63]
push eax
movsx ecx, byte [0xf14f62]
push ecx
push 0xf18430
lea edx, [ebp - 0x310]
push edx
call dword [fcn.00f47970]
add esp, 0x14
xor eax, eax
cmp dword [ebp + 8], 1
sete al
push eax
lea ecx, [ebp - 0x328]
push ecx
lea edx, [ebp - 0x300]
push edx
lea eax, [ebp - 0x200]
push eax
lea ecx, [ebp - 0x100]
push ecx
call fcn.00f308c8
add esp, 0x14
test eax, eax
jne 0xf30e10
cmp dword [ebp - 0x328], 0
je 0xf30da8
lea edx, [ebp - 0x300]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0xf30da8
push 0xf13150
call fcn.00f1a2f1
add esp, 4
push 0
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
lea ecx, [ebp - 0x300]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0xf13150
call fcn.00f1a4f8
add esp, 4
cmp dword [ebp + 8], 1
jne 0xf30dea
lea edx, [ebp - 0x100]
push edx
lea eax, [ebp - 0x324]
push eax
push 0xf18440
push 0xf17219
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [ebp - 0x100]
push ecx
lea edx, [ebp - 0x304]
push edx
push 0xf18448
push 0xf17219
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [ebp + 8], 2
jne 0xf30e10
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x310]
push ecx
lea edx, [ebp - 0x31c]
push edx
push 0xf17219
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov esp, ebp
pop ebp
ret
Function at 0xf3252f
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push 0x32
lea eax, [ebp - 0x34]
push eax
push 0xf18484
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0xf32552
or eax, 0xffffffff
jmp 0xf325f4
lea ecx, [ebp - 0x34]
test ecx, ecx
jne 0xf32561
or eax, 0xffffffff
jmp 0xf325f4
push 0xf18490
lea edx, [ebp - 0x34]
push edx
call fcn.00f1aa74
add esp, 8
test eax, eax
je 0xf3258b
push 0xf18494
lea eax, [ebp - 0x34]
push eax
call fcn.00f1aa74
add esp, 8
test eax, eax
jne 0xf3258f
xor eax, eax
jmp 0xf325f4
push 0xf18498
lea ecx, [ebp - 0x34]
push ecx
call fcn.00f1aa74
add esp, 8
test eax, eax
je 0xf325b9
push 0xf1849c
lea edx, [ebp - 0x34]
push edx
call fcn.00f1aa74
add esp, 8
test eax, eax
jne 0xf325c0
mov eax, 1
jmp 0xf325f4
push 0xf184a0
lea eax, [ebp - 0x34]
push eax
call fcn.00f1aa74
add esp, 8
test eax, eax
je 0xf325ea
push 0xf184a8
lea ecx, [ebp - 0x34]
push ecx
call fcn.00f1aa74
add esp, 8
test eax, eax
jne 0xf325f1
mov eax, 2
jmp 0xf325f4
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0xf325f8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and eax, 0xffff
and eax, 0xff
mov word [ebp - 8], ax
mov eax, dword [ebp - 8]
and eax, 0xffff
cmp eax, 0xc
jne 0xf3262d
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 8]
and ecx, 0xffff
cmp ecx, 7
jne 0xf32642
mov dword [ebp - 4], 2
mov edx, dword [ebp - 8]
and edx, 0xffff
cmp edx, 0xa
jne 0xf32657
mov dword [ebp - 4], 3
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0xf337b2
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movsx eax, byte [0xf14d36]
cmp eax, 2
jne 0xf3380c
cmp dword [ebp + 8], 0
je 0xf337e8
mov ecx, dword [0xf16dc6]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0xf337e6
mov eax, 0x210
jmp 0xf3392f
jmp 0xf33804
mov edx, dword [0xf16dc6]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0xf33804
mov eax, 0x20c
jmp 0xf3392f
mov eax, dword [ebp + 0xc]
jmp 0xf3392f
push 0xf18568
mov eax, dword [0xf47a20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress_1]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xf33830
mov eax, 0x211
jmp 0xf3392f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0xc], eax
push 0
push 4
call dword [0xf48184]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0xf3385f
mov eax, 0x20e
jmp 0xf3392f
mov dword [ebp - 0x30], 0x1c
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [0xf48250]
test eax, eax
jne 0xf33882
mov eax, 0x20f
jmp 0xf3392f
cmp dword [ebp - 0x30], 0x10
jae 0xf33892
mov eax, 0x212
jmp 0xf3392f
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x14]
je 0xf3389c
jmp 0xf3390c
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0xc]
jne 0xf338a6
jmp 0xf3390c
mov edx, dword [ebp - 0x28]
cmp edx, dword [0xf16dd2]
jne 0xf338b3
jmp 0xf3390c
mov eax, dword [ebp - 0x28]
push eax
push 0
push 2
call dword [ebp - 4]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0xf338ce
mov eax, 0x20d
jmp 0xf3392f
cmp dword [ebp + 8], 0
je 0xf338ec
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0xf338ea
mov eax, 0x210
jmp 0xf3392f
jmp 0xf33902
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0xf33902
mov eax, 0x20c
jmp 0xf3392f
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [0xf48194]
test eax, eax
jne 0xf33882
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle_1]
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret
Function at 0xf360ec
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0xf36121
xor eax, eax
jmp 0xf361c1
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x3c], 0x3e8
jbe 0xf36134
xor eax, eax
jmp 0xf361c1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx], 0x4550
je 0xf3614f
xor eax, eax
jmp 0xf361c1
mov eax, dword [ebp - 4]
add eax, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
add ecx, 0x18
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 8]
xor eax, eax
mov ax, word [edx + 0x10]
mov ecx, dword [ebp - 0x18]
add ecx, eax
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x18]
add edx, 0x60
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
je 0xf3619c
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 8]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x18]
cmp dword [ecx], 0
je 0xf361bc
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0xf36ea9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x7530
mov eax, dword [0xf47a58]
push eax
call fcn.00f1ae26
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0xf36ece
mov eax, dword [ebp - 4]
jmp 0xf36f1a
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00f36e03
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [0xf47a58]
push eax
call fcn.00f1ae78
add esp, 4
xor ecx, ecx
mov cl, byte [0xf16dc5]
test ecx, ecx
je 0xf36f17
cmp dword [ebp - 4], 0
je 0xf36f17
xor edx, edx
mov dl, byte [0xf17457]
test edx, edx
jne 0xf36f17
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess_1]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x84d1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0084d140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0084d140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0084d140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0084d140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x84dbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x84dc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x85f87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x84dc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x84dc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x42e005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x10018c6
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x10040c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
push 0x100
xor edi, edi
lea ecx, [ebp - 0x204]
push ecx
push edi
push edi
push edi
push edi
push edi
push edi
push dword [eax]
mov dword [ebp - 0x418], eax
call sub.msvcrt.dll__wsplitpath_s
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0x24
lea eax, [ebp - 0x408]
push eax
push 1
push edi
lea eax, [ebp - 0x204]
push eax
push 0x80000000
call ebx
test eax, eax
je 0x100192d
xor eax, eax
jmp 0x1001a10
push esi
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x404]
push eax
push edi
push dword [ebp - 0x408]
mov dword [ebp - 0x40c], 0x200
call dword [entry0]
push dword [ebp - 0x408]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x410], eax
call esi
cmp dword [ebp - 0x410], edi
jne 0x10019ae
lea eax, [ebp - 0x408]
push eax
push 1
push edi
lea eax, [ebp - 0x404]
push eax
push 0x80000000
call ebx
test eax, eax
jne 0x10019ae
lea eax, [ebp - 0x414]
push eax
push 1
push edi
push 0x1001204
push dword [ebp - 0x408]
call ebx
test eax, eax
je 0x10019b2
push dword [ebp - 0x408]
call esi
xor eax, eax
jmp 0x1001a0f
lea eax, [ebp - 0x40c]
push eax
mov ebx, 0x10041f0
push ebx
push edi
push dword [ebp - 0x414]
mov dword [ebp - 0x40c], 0x104
call dword [entry0]
push dword [ebp - 0x408]
mov dword [ebp - 0x410], eax
call esi
push dword [ebp - 0x414]
call esi
xor eax, eax
cmp dword [ebp - 0x410], edi
jne 0x1001a0f
mov ecx, dword [ebp - 0x40c]
mov word [ecx*2 + 0x10041f0], ax
mov eax, dword [ebp - 0x418]
mov dword [eax], ebx
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.010027d0
leave
ret 4
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x7d8c7956
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..rdata
nop
mov ebx, 0x42e1d0
mov ecx, 0x28207797
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query environment variable

Disassembly:
sub esp, 0x130
mov eax, dword [0x4310d8]
mov dword [esp + 0x12c], eax
mov al, 0x87
mov cl, 0xb0
mov byte [esp + 0x10], al
mov byte [esp + 0x24], al
mov byte [esp], 0x7b
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0x59
mov byte [esp + 3], 0xfe
mov byte [esp + 4], 0x78
mov byte [esp + 5], cl
mov byte [esp + 6], 0xb1
mov byte [esp + 7], 0x27
mov byte [esp + 8], 0x34
mov byte [esp + 9], 0xf8
mov byte [esp + 0xa], 0x7f
mov byte [esp + 0xb], 0x7a
mov byte [esp + 0xc], 6
mov byte [esp + 0xd], 0x30
mov byte [esp + 0xe], 0xcb
mov byte [esp + 0xf], 0xef
mov byte [esp + 0x14], 0x5e
mov byte [esp + 0x15], 0x6d
mov byte [esp + 0x16], 0x10
mov byte [esp + 0x17], cl
mov byte [esp + 0x18], 0x3c
mov byte [esp + 0x19], 0xf9
mov byte [esp + 0x1a], 0xe3
mov byte [esp + 0x1b], 2
mov byte [esp + 0x1c], 0x68
mov byte [esp + 0x1d], 0x8c
mov byte [esp + 0x1e], 0xc
mov byte [esp + 0x1f], 0x1f
mov byte [esp + 0x20], 0x74
mov byte [esp + 0x21], 0x46
mov byte [esp + 0x22], 0xe5
mov byte [esp + 0x23], 0x9c
xor eax, eax
lea ecx, [ecx]
mov dl, byte [esp + eax]
mov cl, byte [esp + eax + 0x14]
xor dl, cl
mov byte [esp + eax], dl
inc eax
cmp eax, 0x11
jl 0x4010c0
push 0x104
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x40111b
xor eax, eax
mov ecx, dword [esp + 0x12c]
call fcn.00424873
add esp, 0x130
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x12c]
mov eax, 1
call fcn.00424873
add esp, 0x130
ret
Function at 0x401140
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query environment variable

Disassembly:
sub esp, 0x130
mov eax, dword [0x4310d8]
mov dword [esp + 0x12c], eax
mov al, 0x87
mov cl, 0xb0
mov byte [esp + 0x10], al
mov byte [esp + 0x24], al
mov byte [esp], 0x7b
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0x59
mov byte [esp + 3], 0xfe
mov byte [esp + 4], 0x78
mov byte [esp + 5], cl
mov byte [esp + 6], 0xb1
mov byte [esp + 7], 0x27
mov byte [esp + 8], 0x34
mov byte [esp + 9], 0xf8
mov byte [esp + 0xa], 0x7f
mov byte [esp + 0xb], 0x7a
mov byte [esp + 0xc], 6
mov byte [esp + 0xd], 0x30
mov byte [esp + 0xe], 0xcb
mov byte [esp + 0xf], 0xef
mov byte [esp + 0x14], 0x5e
mov byte [esp + 0x15], 0x6d
mov byte [esp + 0x16], 0x10
mov byte [esp + 0x17], cl
mov byte [esp + 0x18], 0x3c
mov byte [esp + 0x19], 0xf9
mov byte [esp + 0x1a], 0xe3
mov byte [esp + 0x1b], 2
mov byte [esp + 0x1c], 0x68
mov byte [esp + 0x1d], 0x8c
mov byte [esp + 0x1e], 0xc
mov byte [esp + 0x1f], 0x1f
mov byte [esp + 0x20], 0x74
mov byte [esp + 0x21], 0x46
mov byte [esp + 0x22], 0xe5
mov byte [esp + 0x23], 0x9c
xor eax, eax
lea ecx, [ecx]
mov dl, byte [esp + eax]
mov cl, byte [esp + eax + 0x14]
xor dl, cl
mov byte [esp + eax], dl
inc eax
cmp eax, 0x11
jl 0x401200
push 0x104
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x12c]
call fcn.00424873
add esp, 0x130
ret
Function at 0x4016f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Query environment variable

Disassembly:
sub esp, 0x130
mov eax, dword [0x4310d8]
mov dword [esp + 0x12c], eax
mov al, 0x87
mov cl, 0xb0
mov byte [esp + 0x10], al
mov byte [esp + 0x24], al
mov byte [esp], 0x7b
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0x59
mov byte [esp + 3], 0xfe
mov byte [esp + 4], 0x78
mov byte [esp + 5], cl
mov byte [esp + 6], 0xb1
mov byte [esp + 7], 0x27
mov byte [esp + 8], 0x34
mov byte [esp + 9], 0xf8
mov byte [esp + 0xa], 0x7f
mov byte [esp + 0xb], 0x7a
mov byte [esp + 0xc], 6
mov byte [esp + 0xd], 0x30
mov byte [esp + 0xe], 0xcb
mov byte [esp + 0xf], 0xef
mov byte [esp + 0x14], 0x5e
mov byte [esp + 0x15], 0x6d
mov byte [esp + 0x16], 0x10
mov byte [esp + 0x17], cl
mov byte [esp + 0x18], 0x3c
mov byte [esp + 0x19], 0xf9
mov byte [esp + 0x1a], 0xe3
mov byte [esp + 0x1b], 2
mov byte [esp + 0x1c], 0x68
mov byte [esp + 0x1d], 0x8c
mov byte [esp + 0x1e], 0xc
mov byte [esp + 0x1f], 0x1f
mov byte [esp + 0x20], 0x74
mov byte [esp + 0x21], 0x46
mov byte [esp + 0x22], 0xe5
mov byte [esp + 0x23], 0x95
xor eax, eax
lea ecx, [ecx]
mov dl, byte [esp + eax]
mov cl, byte [esp + eax + 0x14]
xor dl, cl
mov byte [esp + eax], dl
inc eax
cmp eax, 0x11
jl 0x4017b0
push 0x104
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x40180b
xor eax, eax
mov ecx, dword [esp + 0x12c]
call fcn.00424873
add esp, 0x130
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x12c]
mov eax, 1
call fcn.00424873
add esp, 0x130
ret