joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10058830
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x100bed58], eax
je 0x10058854
mov eax, 0x10dd
jmp 0x100589fc
cmp dword [0x100bed5c], 0
je 0x10058867
mov eax, dword [0x100bed5c]
jmp 0x100589fc
cmp dword [ebp + 0xc], 0
jne 0x10058877
mov eax, 0x57
jmp 0x100589fc
cmp dword [ebp + 8], 0
jne 0x10058887
mov eax, 6
jmp 0x100589fc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x100588b0
mov dword [ebp - 8], 6
mov ecx, dword [ebp - 8]
mov dword [0x100bed5c], ecx
mov edx, dword [ebp + 8]
mov dword [0x100bed60], edx
mov eax, dword [ebp - 8]
jmp 0x100589fc
push 0x18
call fcn.10059ee6
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1005890b
mov dword [ebp - 8], 8
mov ecx, dword [ebp - 8]
mov dword [0x100bed5c], ecx
cmp dword [ebp - 4], 0
je 0x100588fa
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
push 0x18
mov eax, dword [ebp - 0x20]
push eax
call fcn.10059f19
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [0x100bed60], ecx
mov eax, dword [ebp - 8]
jmp 0x100589fc
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.10058810
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10058810
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0xc], 0
je 0x1005894b
cmp dword [ebp - 0xc], 0x1e
jbe 0x10058967
mov dword [ebp - 8], 9
cmp dword [0x100bed50], 0
je 0x10058962
jmp 0x100588d9
jmp 0x100588d0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x1005898e
mov dword [ebp - 8], 9
cmp dword [0x100bed50], 0
je 0x10058989
jmp 0x100588d9
jmp 0x100588d0
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x100589b9
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x100588d0
mov edx, dword [ebp - 4]
mov dword [edx + 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x100bed68]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x100bed68], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x10058a10
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x100bed58], eax
je 0x10058a2d
mov eax, 0x10dd
jmp 0x10058b10
mov eax, dword [0x100bed68]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10058aac
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x10058a88
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x10058a88
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.100578b0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.10059f19
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10058a35
mov dword [0x100bed68], 0
call fcn.10058190
mov ecx, dword [0x100bed64]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10058afa
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10059f19
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10058ac4
mov dword [0x100bed64], 0
mov dword [0x100bed58], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10058ff0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x100bed5c], 0
je 0x10059009
mov eax, dword [0x100bed5c]
jmp 0x100590a8
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x1005901a
xor eax, eax
jmp 0x100590a8
push 8
call fcn.10059ee6
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10059072
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1005905b
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.10059f19
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x100bed5c], eax
mov dword [0x100bed60], 0
mov eax, dword [ebp - 8]
jmp 0x100590a8
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x1005908a
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x1005903a
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x100bed64]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x100bed64], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x1005ccfc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x10086581
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10086241

Function at 0x1008fb30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009596e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100bb084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x100bb974]
cmp eax, 0xffffffff
jne 0x1008fb66
xor ebx, ebx
jmp 0x1008fb6f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1008fbb1
nop dword [eax]
cmp dword [ebx + 0x18], 0
mov esi, dword [ebx + 0xc]
jne 0x1008fbf0
test esi, esi
jne 0x1008fbf4
push 0x1008f630
push 0x100bfa24
call fcn.1008f1a0
mov eax, dword [0x100bb974]
add esp, 8
cmp eax, 0xffffffff
je 0x1008fbb1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1008fbde
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1008fbde
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x1008fc36
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1008fc1f
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x1008fbf4
cmp dword [ebx + 0x18], 0
je 0x1008fb80
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x1008fc5d
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x1008fc5d
push eax
mov eax, dword [esi + 0x14]
push ecx
call eax
add esp, 8
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.1008f650
cmp dword [ebx + 0x18], 0
jne 0x1008fc40
jmp 0x1008fb80
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40d02c], 0x8088405
inc edx
mov dword [0x40d02c], edx
mul edx
mov eax, edx

Function at 0x4045a0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
mov eax, esp
call fcn.0040458c
add esp, 0x104
pop ebx
ret

Function at 0x40565c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405695
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40569e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4056a8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x4056c9
mov al, byte [esp]
jmp 0x4056cb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x406e2c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406e74
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406dc8
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406e7b
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x40707c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40710a
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x4070c7
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, esi
call fcn.00403278
jmp 0x4070f4
call sub.kernel32.dll_GetCommandLineA_1
cmp byte [eax], 0
jne 0x4070db
lea eax, [ebp - 4]
call fcn.00403198
jmp 0x4070ea
lea edx, [ebp - 4]
call fcn.00406f40
test ebx, ebx
je 0x4070ea
dec ebx
jmp 0x4070cc
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407111
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x407118
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00405230
add esp, 0x104
pop ebx
ret

Function at 0x407144
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
mov eax, esp
call fcn.00405230
add esp, 0x104
pop ebx
ret
Function at 0x40728c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4073c4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4073ae
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x4072e9
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x4073ae
cmp dword [ebp - 0x10], 0
jne 0x4072fe
mov eax, dword [ebp - 8]
call fcn.00403198
mov bl, 1
jmp 0x4073ae
cmp dword [ebp - 0x10], 0x70000000
jb 0x40730c
call fcn.00405cd4
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
lea eax, [ebp - 0x14]
mov ecx, esi
xor edx, edx
call fcn.00403278
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
call fcn.00403420
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push edi
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 0xea
je 0x4072b2
test eax, eax
jne 0x4073ae
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
je 0x40735c
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jne 0x4073ae
mov esi, dword [ebp - 0x10]
test esi, esi
sar esi, 0
jmp 0x407367
dec esi
test esi, esi
je 0x407375
mov eax, dword [ebp - 0x14]
cmp byte [eax + esi - 1], 0
je 0x407366
cmp dword [ebp - 0xc], 7
jne 0x407380
test esi, esi
je 0x407380
inc esi
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.004034f0
cmp dword [ebp - 0xc], 7
jne 0x4073a1
test esi, esi
je 0x4073a1
lea eax, [ebp - 0x14]
call fcn.00403420
mov byte [eax + esi - 1], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.004031e8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4073cb
lea eax, [ebp - 0x14]
call fcn.00403198
ret
Function at 0x407700
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
push ebx
add esp, 0xfffffc00
mov ebx, edx
push 0
push 0x400
lea edx, [esp + 8]
push edx
push 0
push eax
push 0
push 0x3200
call sub.kernel32.dll_FormatMessageA
pushal
pushfd
mov esi, 0x99198af
call fcn.00406b0b
dec eax
mov eax, esp
neg eax
mov esi, eax
call fcn.00409dd6
rol esi, 1
call fcn.00409dd6
mov edx, edx
shr eax, 0x19
ror esi, 0x1a
mov ecx, dword [0x40c128]
xor edi, ebp
mov ebx, ebp
test esi, 0x370a3e08
jb 0x4077ce
mov ecx, dword [0x40c3f1]
inc esi
xor ecx, edx
mov dword [0x40c6a4], 0x6358d6c
not eax
neg ebx
mov ecx, esp
add edx, eax
or edi, edi
xor esi, eax
dec eax
call fcn.004064fb
shl eax, 4
mov ecx, eax
and esi, edi
add esi, 0x61b90f6
call fcn.004027b1
mov ecx, 0xb31fa2
call fcn.00409dd6
rol edx, 8
mov dword [0x40c914], ecx
call fcn.00409dd6
add byte [eax], al
shr edx, 2
neg edx
xor ebx, dword [0x40c040]
shr eax, 1
xchg eax, edx
neg eax
loop 0x40779a
or dword [0x40c9e8], 0x11c0f5bc
shr eax, 0x16
mov edi, edx
add ebx, edi
or esi, edi
dec esi
mov esi, 0x2403f100
mov ecx, 0xaa2473
stosb byte es:[edi], al
add byte [esi + 0x2b], cl
cmp eax, 0x40c167
dec esi
sub edi, dword [0x40c167]
rol esi, 0xf
shr eax, 0x13
inc edx
rol eax, 0x10
or dword [0x40c481], 0x157a28
inc edx
dec esi
ror eax, 0x11
xor dword [0x40c6f0], ecx
neg eax
mov dword [0x40c640], ebx
loop 0x4077df
test eax, edi
jb 0x4077ab
mov ecx, eax
add esi, eax
test eax, ebx
jo 0x40779f
xchg eax, edx
and eax, 0xd790862
mov ecx, 0x7bb3f6
call fcn.004030ac
xchg esi, esi
rol esi, 0x15
test eax, edx
jb 0x4077dd
mov dword [0x40c8f8], 0x2d706a99
neg eax
call fcn.00406ac0
rol eax, 0x15
call fcn.00406e95
ror esi, 1
neg eax
loop 0x407828
mov esi, esp
dec edi
or esi, edi
xchg ecx, eax
test edx, ebx
jo 0x407890
shr esi, 0x1f
dec ecx
xor esi, eax
dec eax
mov edi, edi
xor ebx, edx
shl esi, 0xb
add edi, eax
xchg esi, eax
not esi
mov eax, 0xf4e99ea
or esi, 0x2345ef8
xor eax, 0x18d8024
inc eax
sub edi, eax
push 0x40
mov dword [0x40c584], 0x1eb1e8a3
not esi
add byte [ebx - 0x8e14e18], ah
salc
xchg esi, eax
not eax
ror eax, 0x1b
xor ecx, dword [0x40c060]
sub ebx, edi
sub ecx, dword [0x40c354]
sub eax, 0xa28ed9
add esi, eax
not eax
call fcn.00409dd6
sub eax, ecx
inc edi
sub ecx, dword [0x40c2bb]
neg ecx
call fcn.00409dd6
xor esi, eax
sub ecx, dword [0x40c0ba]
xor dword [0x40c8d8], ecx
or dword [0x40c6b0], ecx
call fcn.004091e5
call fcn.00405a5b
mov dword [0x40c698], 0xe39c801
push 0x3000
call fcn.00409dd6
or dword [0x40c43c], 0x9953127
xor ebx, esi
sub edi, dword [0x40c164]
sub edx, dword [0x40c392]
call fcn.0040297e
invalid
invalid
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x423bf1
Capabilities:
Set registry value

Disassembly:
push ebx
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x423bf7
call fcn.0043fe00
mov edx, dword [esp + 0x28]
lea ecx, [esp]
call fcn.00434000
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 4]
call fcn.00434000
mov edx, dword [esp + 0x30]
lea ecx, [esp + 8]
call fcn.00434000
push esp
push 0x3e
call fcn.00440ad0
add esp, 8
push 0x20030a
call fcn.00432f10
push 0x20030b
call fcn.00432f10
mov dword [esp + 0xc], 0
push 0x20030e
call fcn.00432f10
call fcn.0041bdb2
push 0x20030e
call fcn.00433063
and eax, eax
je 0x423c7d
mov eax, 1
jmp 0x423c7f
xor eax, eax
and eax, eax
je 0x423ca1
push 0x20030f
call fcn.00432f10
mov dword [esp + 0x18], 0xf013f
push 0x200310
call fcn.00432f10
jmp 0x423cbd
push 0x200310
call fcn.00432f10
push 0x200311
call fcn.00432f10
mov dword [esp + 0x18], 0xf003f
push 0x200312
call fcn.00432f10
push 0x200313
call fcn.00432f10
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x1c]
push 0
mov eax, 0x4ac1aa
push eax
push closesocket
call sub.ADVAPI32.dll_RegOpenKeyExW
push 0x200313
call fcn.00433063
mov ebx, eax
and ebx, ebx
jne 0x423dd3
push 0x200314
call fcn.00432f10
lea eax, [esp + 0x14]
push eax
push dword [esp + 4]
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCreateKeyW
push 0x200314
call fcn.00433063
mov ebx, eax
and ebx, ebx
jne 0x423dac
push 0x200315
call fcn.00432f10
push dword [esp + 8]
call fcn.00435c10
mov ebx, eax
inc ebx
add ebx, ebx
push ebx
push dword [esp + 0xc]
push 2
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegSetValueExW
push 0x200315
call fcn.00433063
mov ebx, eax
and ebx, ebx
jne 0x423d85
push 0x200316
call fcn.00432f10
mov dword [esp + 0xc], 1
push 0x200317
call fcn.00432f10
push 0x200318
call fcn.00432f10
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
push 0x200318
call fcn.00433063
push 0x200319
call fcn.00432f10
push 0x20031a
call fcn.00432f10
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
push 0x20031a
call fcn.00433063
push 0x20031b
call fcn.00432f10
push 0x20031c
call fcn.00432f10
mov eax, dword [esp + 0xc]
jmp 0x423df9
push edx
push eax
call fcn.00440ca0
pop eax
push dword [esp + 8]
call fcn.0043ff30
push dword [esp + 0xc]
call fcn.0043ff30
push dword [esp + 4]
call fcn.0043ff30
pop edx
add esp, 0x20
pop ebx
ret 0xc
Function at 0x424bf0
Capabilities:
Get common file path

Disassembly:
push ebp
push ebx
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x424bf7
call fcn.0043fe00
push dword [esp + 0x30]
call fcn.00434400
push esp
push 0x36
call fcn.00440ad0
add esp, 8
push 0x2002a6
call fcn.00432f10
push 0x2002a7
call fcn.00432f10
lea edx, [esp]
push edx
push 0
push 0xb
push 1
mov eax, 1
push 2
call fcn.00432fc6
call fcn.0043f24a
push 0x2002a8
call fcn.00432f10
push 0
push 0
call sub.KERNEL32.dll_GetSystemDirectoryW
push 0x2002a8
call fcn.00433063
mov dword [esp + 0x20], eax
push 0x2002a9
call fcn.00432f10
mov ebx, dword [esp + 0x20]
and ebx, ebx
jne 0x424cc0
push 0x2002aa
call fcn.00432f10
mov edx, 0x4ac1aa
push edx
call fcn.0043fe60
pop edx
push eax
push edx
call fcn.0043ff60
pop eax
push eax
call fcn.004343d0
pop edx
add eax, edx
jmp 0x424dc4
push 0x2002ab
call fcn.00432f10
push 0x2002ac
call fcn.00432f10
mov eax, dword [esp + 0x20]
inc eax
lea edx, [esp]
push edx
push eax
call fcn.00432fc6
call fcn.0043f398
push 0x2002ad
call fcn.00432f10
mov ebx, dword [esp + 0x20]
add ebx, ebx
push ebx
mov eax, 0
mov edx, dword [esp + 4]
mov edx, dword [edx - 8]
call fcn.00432fd6
mov ebp, dword [esp + 4]
lea eax, [ebp]
push eax
call fcn.0043f6d0
call fcn.0043f9c0
push 0x2002ae
call fcn.00432f10
push dword [esp + 0x20]
mov eax, 0
mov edx, dword [esp + 4]
mov edx, dword [edx - 8]
call fcn.00432fd6
lea eax, [ebp]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryW
push 0x2002ae
call fcn.00433063
mov dword [esp + 0x20], eax
push 0x2002af
call fcn.00432f10
push edx
call fcn.0043fe60
pop edx
push eax
push edx
call fcn.0043fe60
pop edx
push eax
push 0x19
push 0xffffffff
mov eax, 0
mov edx, dword [esp + 0x10]
mov edx, dword [edx - 8]
call fcn.00432fd6
mov ebp, dword [esp + 0x10]
lea eax, [ebp]
push eax
call fcn.0043f800
call fcn.0043fb10
mov edx, 0x4ac376
push edx
call fcn.0043ff60
pop eax
push eax
call fcn.004343d0
pop edx
add eax, edx
jmp 0x424dc4
push edx
push eax
call fcn.00440ca0
pop eax
push eax
push dword [esp + 8]
call fcn.0043f469
pop eax
pop edx
add esp, 0x24
pop ebx
pop ebp
ret

Function at 0x432f10
Capabilities:
Packed with generic packer

Disassembly:
pushal
pushfd
push esp
push dword [esp + 0x2c]
call fcn.00440770
add esp, 8
or eax, eax
je 0x432f28
jmp 0x4015a0
popfd
popal
ret 4
Function at 0x434d6f
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4c224c], 0
push ebx
push esi
mov esi, 0x4c2254
jne 0x434d9b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x4c226c], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4c224c], 1
push dword [0x4c226c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x434e38
push 0x14
push 8
push dword [0x4c1d94]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x434e62
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4c2250]
test eax, eax
je 0x434ddd
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4c2250], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x434e67
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x4c226c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x4c1d94]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x434e62
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8