joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407180
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41feeb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x404844
call fcn.004089bc
push 4
mov dword [esp + 0x18], 0
call fcn.00409905
mov edi, eax
add esp, 4
test edi, edi
je 0x4071f4
push ebx
call fcn.00408798
mov dword [edi], eax
call fcn.0040852f
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.004088fd
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4071e8
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00408925
pop ebx
jmp 0x4071f6
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40a410
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x423448]
jne 0x40a41a
repz ret
jmp fcn.0040f82c
Function at 0x41b51a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x423448]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040efc0
and dword [ebp - 0x14], 0
cmp dword [0x4f6214], 0
mov dword [ebp - 0x18], eax
jne 0x41b5cd
push 0x4042a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41b675
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x404294
push ebx
call edi
test eax, eax
je 0x41b675
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x404284
push ebx
mov dword [0x4f6214], eax
call edi
push eax
call esi
push 0x404270
push ebx
mov dword [0x4f6218], eax
call edi
push eax
call esi
push 0x404254
push ebx
mov dword [0x4f621c], eax
call edi
push eax
call esi
mov dword [0x4f6224], eax
test eax, eax
je 0x41b5cd
push 0x40423c
push ebx
call edi
push eax
call esi
mov dword [0x4f6220], eax
mov eax, dword [0x4f6220]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41b626
cmp dword [0x4f6224], ecx
je 0x41b626
push eax
call esi
push dword [0x4f6224]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41b626
test ebx, ebx
je 0x41b626
call edi
test eax, eax
je 0x41b61d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41b61d
test byte [ebp - 8], 1
jne 0x41b626
or dword [ebp + 0x10], 0x200000
jmp 0x41b659
mov eax, dword [0x4f6218]
cmp eax, dword [ebp - 0x18]
je 0x41b659
push eax
call esi
test eax, eax
je 0x41b659
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41b659
mov eax, dword [0x4f621c]
cmp eax, dword [ebp - 0x18]
je 0x41b659
push eax
call esi
test eax, eax
je 0x41b659
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4f6214]
call esi
test eax, eax
je 0x41b675
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41b677
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a410
leave
ret
Function at 0x41ebe0
Capabilities:
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x1798
call fcn.0041c3c0
cmp dword [0x9a0684], 0x37
push esi
jne 0x41ecfd
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualLock]
push 0
lea ecx, [esp + 0x39c]
push ecx
push 0x4043d4
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 0x28]
push edx
push 0
push 0
push 0
call esi
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_ReadFileScatter]
push 0
lea ecx, [esp + 0x79c]
push ecx
push 0x4043e0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0
lea edx, [esp + 0xf9c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 0x178]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push 0
call esi
push 0x404428
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
lea edx, [esp + 0x1c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0x30
lea ecx, [esp + 0x34]
push 0
push ecx
mov dword [esp + 0x38], 0
call fcn.00411c00
add esp, 0xc
lea edx, [esp + 0x2c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CommConfigDialogW]
mov eax, dword [0x9a2de8]
mov dword [esp + 4], eax
mov eax, 0x5d1
add dword [esp + 4], eax
mov ecx, dword [esp + 4]
mov dl, byte [ecx + ebx]
mov eax, dword [0x99ee70]
mov byte [eax + ebx], dl
pop esi
add esp, 0x1798
ret
Function at 0x95e1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0095e140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0095e140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0095e140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0095e140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x95ebfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x95ec50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x97087c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x95ec43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x95ec52
xor eax, eax
pop esi
leave
ret 4

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x11f1525
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
mov eax, str._v_ro
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0xd4b38df
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4310c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x77542549
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x505c1e61
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x4018c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x403464], eax
mov edi, 0
mov ecx, 0xa
push edi
loop 0x4018dd
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [0x403464]
mov dword [ebp - 0x1c], edx
lea ecx, str.contents
mov dword [ebp - 8], ecx
lea eax, section..text
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0x67
push dword [0x403464]
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x66
push dword [0x403464]
call dword [sym.imp.USER32.dll_LoadBitmapA]
xor eax, eax
push eax
push dword [0x403464]
push eax
push eax
push 0x1f4
push 0x2f4
push 0x578
push 0xce4
push 0
mov ecx, str.frantically
push eax
push str.contents
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403474], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403474]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x4019a6
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x40198d
pop ebp
ret 0x10
Function at 0x401250
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [0x420b5c], 0
je 0x401266
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret 4
push esi
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
jns 0x40129a
cmp esi, 0x80010106
jne 0x4012fa
push str.Mscoree.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4012a1
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
mov byte [0x420bf6], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.00401330
cmp al, 1
jne 0x4012e8
push ecx
call fcn.004015a0
mov esi, eax
test esi, esi
jne 0x4012c8
call fcn.00401630
jmp 0x4012ca
js 0x4012eb
call fcn.00401800
cmp byte [0x420bf4], 0
mov esi, eax
je 0x4012eb
push dword [0x420bf0]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4012eb
mov esi, dword [ebp - 4]
cmp byte [0x420bf6], 0
je 0x4012fa
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x401700
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x420be8], eax
test eax, eax
jne 0x40171f
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 4]
push eax
push 0
push 0x420bb8
push 0x401760
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x401752
push dword [0x420be8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x420be8], esi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402ff0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x403005
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
jmp 0x403010
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403010
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x403090
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x4030a9
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4030b5
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x4030b0
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x404490
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413e46
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x41e008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x438], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x420], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x42c], edi
test edi, edi
jne 0x40453c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x42c], eax
test edi, edi
jne 0x40453c
call fcn.00402920
mov esi, eax
jmp 0x40462c
push dword [ebp - 0x428]
push dword [ebp - 0x424]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x40455f
call fcn.00402920
jmp 0x40461f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x424], ebx
test ebx, ebx
jne 0x40457d
call fcn.00402920
jmp 0x40461f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x428], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x40459e
mov esi, 0x8007000e
jmp 0x404621
push eax
lea ecx, [ebp - 0x420]
mov byte [ebp - 4], 2
call fcn.004028d0
jmp 0x4045c8
mov dword [ebp - 4], 1
cmp dword [ebp - 0x420], 0
jne 0x4045df
mov esi, 0x8007000e
jmp 0x404621
push esi
push dword [ebp - 0x420]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x4045ff
call fcn.00402920
jmp 0x40461f
mov eax, dword [ebp - 0x420]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x434]
push dword [ebp - 0x420]
call fcn.00404330
mov esi, eax
test edi, edi
je 0x40462c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x404650
lea ecx, [ebp - 0x420]
call fcn.00402880
jmp 0x404650
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004063db
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40d3a5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41e008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040907c
mov dword [ebp - 0x14], eax
cmp dword [0x420b28], esi
jne 0x40d498
push 0x800
push esi
push 0x417804
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d425
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d578
push esi
push esi
push 0x417804
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d578
push 0x41781c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d578
push eax
call ebx
push 0x417828
push edi
mov dword [0x420b28], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x417838
push edi
mov dword [0x420b2c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x41784c
push edi
mov dword [0x420b30], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x420b38], eax
test eax, eax
je 0x40d495
push 0x417868
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x420b34], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d4bd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d4b0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d4d2
push 4
pop eax
jmp 0x40d57a
cmp dword [ebp - 0x14], esi
je 0x40d4d2
push dword [0x420b28]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d4b7
mov eax, dword [0x420b34]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d530
cmp dword [0x420b38], edi
je 0x40d530
push eax
call ebx
push dword [0x420b38]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d530
test eax, eax
je 0x40d530
call ecx
test eax, eax
je 0x40d525
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d525
test byte [ebp - 8], 1
jne 0x40d530
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d560
mov eax, dword [0x420b2c]
cmp eax, edi
je 0x40d55d
push eax
call ebx
test eax, eax
je 0x40d55d
call eax
mov esi, eax
test esi, esi
je 0x40d55d
mov eax, dword [0x420b30]
cmp eax, edi
je 0x40d55d
push eax
call ebx
test eax, eax
je 0x40d55d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x420b28]
call ebx
test eax, eax
je 0x40d578
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d57a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004063db
mov esp, ebp
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4f5d0ad6
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x188b24b7
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x2d817083
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2d8e2e01
call fcn.2d805d6a
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x30]
push eax
push str.SoftwareMicrosoftInternet_Explorer
xor ebx, ebx
push 0x80000002
mov dword [ebp - 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x2d8170b6
xor al, al
jmp 0x2d81717e
push ebx
mov byte [ebp - 0x2c], bl
lea ecx, [ebp - 0x28]
push dword [ebp - 0x2c]
xor eax, eax
mov dword [ebp - 0x18], ebx
push 0x100
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.2d8d6ffa
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x38]
xor edi, edi
mov dword [ebp - 0x38], eax
inc edi
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
push eax
push ebx
push str.Version
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
test eax, eax
jne 0x2d81712f
lea eax, [ebp - 0x28]
cmp esi, eax
je 0x2d81712f
cmp dword [ebp - 0x14], 8
mov ecx, esi
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.2d8d6ffa
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x2d81717c
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], edi
cmp eax, 0x1000
jb 0x2d817173
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.2d8d6ffa
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call fcn.2d8d6ffa
pop ecx
pop ecx
mov al, bl
call fcn.2d807648
ret
Function at 0x2d8357c4
Capabilities:
Get disk information

Disassembly:
push 0x3c
mov eax, 0x2d8e5ab1
call fcn.2d805d6a
mov esi, dword [ebp + 8]
xor ebx, ebx
push esi
call fcn.2d8d6ffa
pop ecx
test al, al
je 0x2d83591e
lea eax, [ebp - 0x44]
push eax
push ebx
push esi
call fcn.2d8354bd
add esp, 0xc
test eax, eax
jne 0x2d835926
push dword [ebp - 0x44]
push 1
call fcn.2d8d6ffa
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x2d835926
lea eax, [ebp - 0x44]
push eax
push edi
push esi
call fcn.2d8354bd
add esp, 0xc
test eax, eax
jne 0x2d835926
mov byte [edi + 3], bl
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], bl
call fcn.2d82c3ac
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.2d8361de
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 4], bl
pop ecx
pop ecx
cmp eax, 0x10
jb 0x2d8358a4
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 2
cmp eax, 0x1000
jb 0x2d835898
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.2d8d6ffa
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
push eax
push ecx
call fcn.2d8d6ffa
pop ecx
pop ecx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
cmp eax, 2
je 0x2d8358c0
cmp eax, 5
jne 0x2d8358c2
mov bl, 1
mov eax, dword [0x2d96a8d4]
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x2d8fb384]
call esi
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
pop ecx
cmp eax, 8
jb 0x2d83591e
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 3
cmp eax, 0x1000
jb 0x2d835915
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.2d8d6ffa
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x44]
push eax
push ecx
call fcn.2d8d6ffa
pop ecx
pop ecx
mov al, bl
call fcn.2d807648
ret
xor al, al
jmp 0x2d835920