joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104cd8f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x2d7b0668
mov eax, ecx
lea esp, [esp + 0xc]
jno 0x105ad834
pushfd
push ebp
pushal
lea esp, [esp + 0x28]
jb 0x104cd53e
bsf ax, bp
movzx ax, cl
sar ah, 6
cmp ecx, 0xa
pushfd
mov eax, 3
lea esp, [esp + 4]
pushfd
lea esp, [esp + 0x30]
jb 0x105b49d6
jae 0x104c870a
setg bl
pop ebx
movzx cx, cl
pushfd
mov ecx, dword [esp + 4]
inc al
rcl eax, 0x12
and ah, 0x75
rcl ax, 1
mov byte [ebp - 2], dl
ror ah, cl
cmp bl, 0x73
cmp ecx, 4
jmp 0x1047fdff
jmp 0x105adfbd
push ecx
lea esp, [esp + 4]
jb 0x104cd53e
jmp 0x1062f135
pushal
lea esp, [esp + 0x20]
jae 0x104c870a
aas
xadd bh, al
pop ebx
pushal
mov ecx, dword [esp + 0x20]
pushal
shr al, 6
movzx ax, cl
mov byte [ebp - 2], dl
sbb al, ah
shrd ax, dx, cl
or ah, 0xb7
sal al, 3
cmp ecx, 4
jmp 0x1063a879
lahf
bswap ax
call fcn.105ab747
or eax, 0xd80b553f
inc ecx
mov esi, 0x911afe97
xlatb
les ebx, [eax - 0x1777d0f7]
mov eax, dword [0x97f62e67]
mov cl, 0xf2
jb 0x1063a8d6
add ecx, dword [edx + 0x7a1b2582]
adc byte [ebp + 0x6e7ecaaa], 3
jno 0x1063a8e1
insb byte es:[edi], dx
cwde
adc ebp, dword [ecx - 0x36]
mov esi, 0x99506ec6
pop ebp
push esp
pushal
xchg ebx, eax
inc ebp
jns 0x1063a8df
retf 0xc6be
in eax, dx
mov al, byte [0x16466dd7]
jg 0x1063a87a
imul edx, dword [eax - 0x35], 0x7d
lodsb al, byte [esi]
adc al, 0xaf
out dx, al
pop ebp
rcl ecx, 6
jb 0x1063a8b0
pop esp
inc ebx
xchg dword [ebp - 0x245a8ddb], ecx
push esi
lea esp, [0x56dba572]
mov ebp, 0xf212dbd7
adc dh, dl
daa
bnd jp 0x1063a87a
add cl, byte [esi]
jns 0x1063a922
loop 0x1063a947
pop ecx
test al, 0xf0
invalid
inc ebx
in al, dx
insb byte es:[edi], dx
invalid
add byte [ecx + ebx*8 + 0x41f33820], ah
shl byte [edx + 0x53d05c83], cl
mov bl, 0xd6
inc ecx
mov esi, 0x238cc43f
xor dword [eax - 0x1c], edx
retf

Function at 0x106354dd
Capabilities:
Encode data using xor

Disassembly:
jmp 0x106387fe
lea esp, [esp + 4]
jne 0x1062e8f3
pushal
lea esp, [esp + 0x20]
ja 0x10631fa7
pushal
add ah, 0x20
add esp, 0x20
cmp ah, 0x5a
jmp 0x10631f8b
pushal
pushfd
pushal
lea esp, [esp + 0x44]
ja 0x10631fa7
xchg dword [edi + edx*4 + 0x6860ffff], ebx
les esi, [ebx]
lahf
cli
pushal
push 0xfa9f33c4
clc
stc
add ah, 0x20
cmp ah, 0xfd
or al, al
push edx
call fcn.10639c8d
outsb dx, byte [esi]
xchg esi, eax
ficom word [eax + edi*8 - 0x78df41bf]
lodsd eax, dword [esi]
push es
push 0x2b
stc
scasb al, byte es:[edi]
mov dl, 3
xor eax, 0x49139864
test cl, 0x93
sbb al, 0xb8
loope 0x10638806
lcall 0x2f55, 0xca081f2d
mov ebx, dword [ebx + eax - 0xb]
mov ebx, 0x77bc8897
rol dword [edi + 0x76fa012f], 0xa9
in al, 0x3a
outsb dx, byte [esi]
iretd

Function at 0x1063c31c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [esp], 0x2f17
push dword [0x1063e457]
pop dword [esp + 0x30]
movsx esi, dl
mov dword [esp + 0x2c], 0
call fcn.1063c4dc
Function at 0x1063cb39
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push dword [esp + 0xc]
pushfd
pop dword [esp + 0x30]
push esi
jmp 0x1063bdc9
pushfd
push dword [esp + 0x38]
pop dword [ebp]
push dword [esp + 4]
mov word [esp + 4], si
lea esp, [esp + 0x40]
jmp 0x1063b95a
jmp 0x1063da11
lea esp, [esp + 4]
je 0x1063da1f
call fcn.1063c743
push edx
shr al, 5
pushal
jmp 0x1063e04d
jmp 0x1063bc96
mov dword [ebp - 4], ecx
mov word [esp + 4], di
pushal
test bh, ch
or ecx, ecx
lea esp, [esp + 0x28]
jle 0x1063cf6c
pushal
lea esp, [esp + 0x20]
je 0x1063da1f
push 0xb5805a85
pushfd
cmc
pushal
xor eax, eax
clc
push edx
cmp esp, 0xc4bd781d
push 0x32fd75d5
xchg dword [ebp + ecx*4], eax
mov byte [esp], dh
mov dword [esp + 0x2c], eax
mov word [esp + 8], sp
sub ecx, 1
jmp 0x1063c33c
push ebp
jmp 0x1063c844
mov byte [esp], cl
pushfd
lea esp, [esp + 0x30]
jne 0x1063cb5b
test bx, 0x5dee
sub eax, eax
pushal
xchg dword [ebp], eax
call fcn.1063b9b2
mov eax, dword [ebp]
call fcn.1063d1da
pushfd
mov dword [esp], ebp
push 0xa0d8fe6
push 0xe8326d60
mov dword [esp + 4], ecx
pushfd
mov dword [esp + 4], eax
pushal
call fcn.1063d397
bt esi, eax
clc
stc
shrd eax, edx, cl
pushfd
push dword [esp + 0x14]
mov dword [ebp + 4], eax
jmp 0x1063cac6

Function at 0x1063e250
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xchg dword [esp + 0x2c], esi
call fcn.1063dff9

Function at 0x1063e259
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1063c5ef
mov dword [esp + 0x30], 0
lea esi, [edx + 0x78f9dbcf]
movzx si, cl
call fcn.1063b83d
push dword [esp]
jmp 0x1063c6d6
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x3a530b5e
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x38d91789
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40318c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00405758
test esi, esi
jne 0x4031c2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00405848
jmp 0x4031e0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403090
mov edi, eax
test esi, esi
je 0x4031e0
cmp dword [ebx], 0
je 0x4031e0
dec esi
jmp 0x4031c9
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403218
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4eb008], 0x8088405
inc edx
mov dword [ebx + 0x4eb008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403234
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4eb008], 0x8088405
inc edx
mov dword [ebx + 0x4eb008], edx
fld qword [ebx + 0x4eb760]
push 0
push edx
fild qword [esp]
add esp, 8
fmulp st(1)
pop ebx
ret

Function at 0x404650
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4eb024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4046e8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4046c8
xor eax, eax
push ebp
push 0x4046c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x404704
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4046c8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x4eb024]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4eb024], ax
mov esp, ebp
pop ebp
ret

Function at 0x405504
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4f204c], 0
je 0x405565
cmp word [0x4f2220], 0xd7b2
jne 0x40552d
cmp dword [0x4f2228], 0
jbe 0x40552d
mov eax, 0x4f221c
call dword [0x4f2238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40558c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4eb030], 0
jne 0x405581
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4056dc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x4eb038], 0
je 0x405702
mov edx, esi
mov eax, ebx
call dword [0x4eb038]
jmp 0x405711
mov eax, 8
call fcn.00402d94
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x4f204d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x4056a4
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x407028
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x407258
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4070ab
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x407258
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4070ab
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x407274
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x407134
xor eax, eax
push ebp
push 0x40712d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00406e64
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x407112
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x407294
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x407112
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407134
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40724e
cmp byte [ebp - 0xd], 0
jne 0x40717b
cmp byte [ebp - 0x12], 0
je 0x40724e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x407194
dec ebx
cmp byte [ebx], 0x2e
je 0x4071a3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x407193
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40724e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4071e0
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40724e
cmp byte [ebp - 0xd], 0
je 0x40724e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40724e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409ad4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x409b64
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x409b64
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x409b17
test edx, 3
jne 0x409b06
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x409b11
jmp 0x409b17
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x409b17
cmp dword [ecx - 8], 1
je 0x409b21
mov edx, ebx
or edx, 3
call fcn.00405eb4
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x409b33
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00405758

Function at 0x409b70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x409c00
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x409c00
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x409bb3
test edx, 3
jne 0x409ba2
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x409bad
jmp 0x409bb3
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x409bb3
cmp dword [ecx - 8], 1
je 0x409bbd
mov edx, ebx
or edx, 3
call fcn.00405eb4
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x409bcf
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00405758

Function at 0x40a8d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405c2c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40a8e9
test al, 0x10
je 0x40a8ed
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40a8f4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00405c2c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40a90d
test al, 0x10
jne 0x40a911
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x40e23c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40e275
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00405848
jmp 0x40e27e
mov eax, ebx
mov edx, esi
call fcn.004057ac
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40e288
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40e2aa
movzx eax, byte [esp]
jmp 0x40e2ac
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40e93c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40e7b4
mov eax, dword [0x4f17b4]
cmp byte [eax], 0
je 0x40e9b8
mov eax, dword [0x4f1400]
call fcn.00403650
call fcn.00402ef0
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.0040aff8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40ea00
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40e9ee
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4f1370]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4f47f8]
call fcn.00406e0c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x40f294
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40f36a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004057f0
lea eax, [ebp - 4]
call fcn.00405c7c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405c2c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40f354
mov eax, ebx
call fcn.00402d94
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40f34d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00405c2c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40f337
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40f37c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40f337
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f354
mov eax, dword [ebp - 0x10]
call fcn.00402db0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f371
lea eax, [ebp - 4]
call fcn.00405758
ret

Function at 0x422dcc
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.00422b08
dec esi
jne 0x422dee
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x423f60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4f5308
cmp dword [edi], 0
jne 0x423fdc
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4f5304]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4ebc5c
mov ecx, 2
call fcn.00402f90
mov edx, 0x423f38
lea eax, [esi + 5]
call fcn.00423f58
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00423f58
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x423fb1
mov dword [0x4f5304], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x427a50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.0042734c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00405c2c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x427aaf
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4f1620]
mov dl, 1
mov eax, dword [0x427244]
call fcn.0040eafc
call fcn.004050cc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x427ab8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00405c2c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x427b10
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4f19a8]
mov dl, 1
mov eax, dword [0x427244]
call fcn.0040eafc
call fcn.004050cc
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0042737c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x428ca0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x428ca6
ret
Function at 0x43d864
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405c1c
xor eax, eax
push ebp
push 0x43d999
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x43d96c
xor edx, edx
push ebp
push 0x43d965
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x43d8b1
sub eax, 4
mov eax, dword [eax]
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43d93a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x43d929
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x43d8f0
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.00405c2c
lea ecx, [ebx + 1]
mov edx, esi
call fcn.00402f90
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43d930
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x4f1294]
mov dl, 1
mov eax, dword [0x408d50]
call fcn.0040eac0
call fcn.004050cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43d9a0
lea eax, [ebp - 4]
call fcn.00405758
ret
Function at 0x43d9a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x43db63
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00405f18
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x43db7c
call fcn.00405a78
mov eax, ebx
call fcn.004234e0
mov edi, eax
dec edi
test edi, edi
jl 0x43da60
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.004234b4
mov edx, dword [0x435070]
call fcn.004049e4
test al, al
je 0x43da5c
push dword [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.004234b4
lea edx, [ebp - 0x14]
call fcn.0044c3a8
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00405f18
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405aec
inc esi
dec edi
jne 0x43da0e
movzx eax, byte [0x43db80]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x43db8c
mov eax, dword [ebp - 8]
call fcn.0040fe98
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.004057f0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0044c3a8
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x43db7c
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x360]
call fcn.0044c3a8
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x43db7c
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x43db7c
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x43db98
call fcn.0040baac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43db6a
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.0040577c
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040577c
lea eax, [ebp - 0x14]
call fcn.00405758
lea eax, [ebp - 0x10]
call fcn.00405758
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040577c
ret