joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4992e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x637530]
xor edx, edx
cmp eax, edx
jne 0x499306
xor eax, eax
mov byte [eax + 0x637430], al
inc eax
cmp eax, 0x100
jl 0x4992ee
mov dword [0x637530], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x637430
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x499397
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x49936a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x499338
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4993a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4993f3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4993da
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49fd90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ed23e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004a06b0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x4ffda4
call fcn.004ddfe2
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x49fe23
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004ddfe2
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x49fe1c
push 0
mov ecx, eax
call fcn.00496f20
mov dword [esi + 0xc], eax
jmp 0x49fe25
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x49fe25
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4b13a0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
jne 0x4b13b0
mov esi, 1
push esi
call fcn.004c7ae7
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4b1402
call fcn.004c860d
mov edi, eax
call fcn.004b3f10
mov ecx, dword [edi]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov edi, eax
and edi, 8
je 0x4b13e6
mov edx, dword [0x55e388]
mov dword [0x55e384], edx
test al, 0x18
je 0x4b13f7
push esi
push 0x24
push 5
call fcn.004b4760
add esp, 0xc
test edi, edi
je 0x4b141d
push 1
call fcn.004c9501
test byte [esp + 0x14], 0x20
je 0x4b141d
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x4b2520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov edx, dword [ebp + 0x10]
test edx, edx
push ebx
push esi
push edi
je 0x4b2614
cmp byte [edx], 0
je 0x4b2607
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
add eax, 8
or ecx, 0xffffffff
mov dword [esp + 0xc], eax
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [esp + 0x20]
push ecx
mov esi, ebx
call fcn.004b24a0
mov edi, dword [ebp + 0xc]
push 8
lea edx, [esp + 0x20]
push edi
push edx
call fcn.004b24a0
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
xor eax, edx
push eax
xor ecx, dword [esp + 0x34]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.004b2410
mov eax, dword [esp + 0x30]
add esp, 0x24
cmp edi, eax
jae 0x4b25d1
sub eax, edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
call fcn.004b2450
fmul qword [0x500640]
push ecx
fstp qword [esp]
call fcn.004c6438
fadd qword [0x500638]
add esp, 8
call fcn.004c6508
mov byte [ebx], al
inc ebx
dec edi
jne 0x4b25a4
lea ecx, [esp + 0x20]
push ecx
call fcn.004b2450
fmul qword [0x500640]
push ecx
fstp qword [esp]
call fcn.004c6438
add esp, 8
call fcn.004c6508
cmp esi, ebx
je 0x4b25fd
xor byte [esi], al
inc esi
cmp esi, ebx
jne 0x4b25f6
mov byte [ebx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov byte [edx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
mov byte [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b29e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
lea eax, [ebx + 0x134]
push edi
lea esi, [ebx + 0x34]
mov dword [esp + 0x14], eax
xor edi, edi
mov ecx, dword [ebx + 0x1c]
mov ebp, edi
and ebp, 0xff
mov al, byte [ecx + ebp + 1]
test al, 3
je 0x4b2a10
mov byte [edi + esi], 2
jmp 0x4b2a47
test al, 4
je 0x4b2a1a
mov byte [edi + esi], 0xd
jmp 0x4b2a47
mov edx, dword [ebx + 0x240]
push edi
push ebx
call dword [edx + 4]
add esp, 8
cmp eax, 1
jle 0x4b2a33
mov byte [edi + esi], 2
jmp 0x4b2a47
mov eax, dword [ebx + 0x1c]
test byte [eax + ebp + 1], 0x17
jne 0x4b2a43
mov byte [edi + esi], 0x19
jmp 0x4b2a47
mov byte [edi + esi], 1
inc edi
cmp edi, 0x100
jb 0x4b29f7
mov ecx, dword [esp + 0x14]
mov al, 7
mov byte [esi + 0x21], al
mov byte [esi + 0x3d], al
mov byte [esi + 0x3e], al
mov al, 0x10
mov byte [esi + 0x7c], al
mov byte [esi + 0x26], al
mov byte [esi + 0x24], 2
mov byte [esi + 0x5f], 2
mov byte [esi + 0x27], 9
mov byte [esi + 0x2e], 0xf
mov byte [esi + 0x3c], 8
mov byte [esi + 0x23], 0xa
mov byte [esi + 0x3b], 0x15
mov byte [esi + 0x3a], 0x16
mov byte [esi], 0x11
mov byte [esi + 0x5c], 0x12
mov byte [esi + 0x2f], 0x13
mov byte [esi + 0x2a], 0x14
mov byte [esi + 0x40], 0x17
mov byte [esi + 0x60], 0x1a
mov byte [esi + 0x22], 0x20
mov eax, esi
sub ecx, esi
mov edi, 0x100
mov dl, byte [eax]
cmp dl, 2
je 0x4b2abb
cmp dl, 0xd
je 0x4b2abb
xor edx, edx
jmp 0x4b2ac0
mov edx, 1
mov byte [ecx + eax], dl
inc eax
dec edi
jne 0x4b2aab
mov al, 0x1d
mov byte [esi + 0x58], al
mov byte [esi + 0x78], al
mov al, 0x1f
pop edi
mov byte [esi + 0x62], 0x1e
mov byte [esi + 0x4e], al
mov byte [esi + 0x6e], al
pop esi
pop ebp
pop ebx
ret

Function at 0x4b2ae0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
push 0x4000
call fcn.004b13a0
mov esi, eax
add esp, 8
test esi, esi
jne 0x4b2b01
pop edi
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esp + 0x10]
push ebx
push 0
push eax
call fcn.004b4150
mov edi, eax
add esp, 0xc
test edi, edi
jge 0x4b2b26
push esi
call fcn.004b1430
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
ret
push ebp
push 0x4000
push esi
push edi
call fcn.004cb15c
push ebx
push edi
mov ebp, eax
call fcn.004b41c0
push 0x4b2b60
push ebp
push esi
call fcn.004b54f0
push esi
call fcn.004b1430
add esp, 0x24
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x4b3e80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push 0x655e60
xor bl, bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x655d80]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4b3efb
push 0x4c
push 1
call fcn.004c8a35
mov esi, eax
add esp, 8
test esi, esi
jne 0x4b3ec3
push 0x655e60
mov bl, 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret
mov ecx, dword [0x655d80]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x6472d0]
inc eax
lea edx, [esi + 0xc]
mov dword [0x6472d0], eax
push edx
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 4]
push 0
push eax
call fcn.004b79c0
add esp, 8
mov byte [esi + 0x3c], 1
push 0x655e60
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret

Function at 0x4b4380
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.004c860d
mov ebx, dword [esp + 0x14]
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
call fcn.004cb15c
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x4b447a
call fcn.004c860d
cmp dword [eax], 0
je 0x4b43c7
call fcn.004c860d
mov ebp, dword [eax]
jmp 0x4b43ca
or ebp, 0xffffffff
call fcn.004b3f10
test esi, esi
mov dword [eax], ebp
jne 0x4b43df
call fcn.004c860d
cmp dword [eax], 4
je 0x4b442f
mov eax, dword [esp + 0x20]
test al, 0x1a
je 0x4b4412
cmp esi, 0xffffffff
je 0x4b4454
test al, 6
je 0x4b4412
call fcn.004b3f10
mov ecx, dword [eax]
push ecx
push ebx
call fcn.004b79f0
add esp, 4
push eax
push 0x24
push 9
call fcn.004b4760
mov eax, dword [esp + 0x30]
add esp, 0x10
cmp esi, 0xffffffff
je 0x4b4472
test al, 6
je 0x4b4420
test ah, 2
je 0x4b4472
test esi, esi
jbe 0x4b447e
test ah, 2
je 0x4b447e
add dword [esp + 0x18], esi
sub edi, esi
call fcn.004c860d
mov edx, dword [esp + 0x18]
push edi
push edx
push ebx
mov dword [eax], 0
call fcn.004cb15c
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x4b447a
jmp 0x4b43b4
call fcn.004b3f10
mov eax, dword [eax]
push eax
push ebx
call fcn.004b79f0
add esp, 4
push eax
push 0x24
push 2
call fcn.004b4760
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x20]
test al, 6
je 0x4b448b
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
test ah, 2
je 0x4b4494
mov esi, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x4c95f4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4c9614
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004c859a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4c9637
test byte [esp + 8], 2
je 0x4c9637
call fcn.004c860d
mov dword [eax], 0xd
call fcn.004c8616
mov dword [eax], 5
jmp 0x4c9610
xor eax, eax
ret
Function at 0x4e0672
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4e06aa
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004de6fc
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004de6d4
jmp 0x4e06b6
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4e1d60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4e1da2
call fcn.004e78d9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4e1da2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4e1d99
xor eax, eax
jmp 0x4e1daa
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004e1db0
pop edi
pop esi
pop ebx
ret 4

Function at 0x4e7e09
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4e7e37
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4e7e55
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004e7d6f
jmp 0x4e7e55
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4e7e55
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004e7d6f
test edi, edi
mov eax, edi
jne 0x4e7e3f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4189d3
Capabilities:
Encode data using xor

Disassembly:
stc
cmpsd dword [esi], dword es:[edi]
jecxz 0x418997
push es
mov esp, 0x881c9c08
mov byte [eax + eax*2 - 0x18], cl
mov edx, 0x36ecf462
int 0x45

Function at 0x418a27
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0xc5
salc
invalid
fidiv word [ecx + ecx]
or ecx, edi
xor dword [ebp - 0x22293bf4], esp
xchg edx, eax
or al, 0x27
mov ebp, 0xbd158e0e
dec ebp
outsb dx, byte [esi]
aam 0x97
mov bh, 7
jnp 0x418a24
sbb byte [ebp - 0x1b041298], ch
lea ecx, [eax - 0x7677fdaa]
inc ebx
shl dword [ecx], 0x41
xchg ebp, eax
invalid

Function at 0x4194d0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc
mov al, byte [0x4cd04e]
push esi
mov esi, ecx
push edi
mov cl, byte [0x4cd043]
xor cl, al
mov al, byte [0x4cd041]
mov byte [0x4cd043], cl
mov cl, al
or cl, 0xc
shr cl, 2
and ecx, 0xff
mov dword [esp + 8], ecx
fild dword [esp + 8]
fdivr qword [0x4d0a08]
fadd qword [0x4d09a8]
fstp qword [0x4d0a08]
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x4195e5
mov dl, byte [0x4cd045]
mov cl, byte [0x4cd04d]
or dl, 2
or al, cl
shr dl, 1
and edx, 0xff
mov byte [0x4cd041], al
mov dword [esp + 8], edx
fild dword [esp + 8]
fdivr qword [0x4cd058]
fadd qword [0x4cb350]
fstp qword [0x4d09a8]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x419593
mov edx, dword [0x4d0af4]
push 0x4d07e0
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, dword [0x4d0af4]
push eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov dword [0x4cffc8], eax
push str.uxtheme.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [0x4cd03c]
mov edi, eax
mov dword [esp + 0x10], 0
lea edx, [ecx*4]
mov ecx, dword [0x4cd038]
or edx, ecx
mov dword [esp + 0xc], edx
fild qword [esp + 0xc]
fstp qword [0x4cd058]
call fcn.00419410
test edi, edi
mov dword [esi], edi
je 0x4195e5
push str.IsThemeActive
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 8], eax
pop edi
pop esi
add esp, 0xc
ret
Function at 0x473670
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492170
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4a2018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x4a2a18], 0xffffffff
jne 0x473727
push 0x49dd24
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x4736cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4736cb
mov ecx, eax
call fcn.004721b0
jmp 0x473722
push str.RtlGetVersion
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x4736f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4736f4
mov ecx, eax
call fcn.004721b0
test esi, esi
je 0x473722
jmp 0x473722
push 0x4a3f20
mov ecx, edi
mov dword [0x4a3f20], 0x11c
call dword [0x493148]
call edi
test eax, eax
je 0x47371c
test esi, esi
je 0x473715
mov eax, 0x8000004b
jmp 0x473722
test esi, esi
je 0x473720
xor eax, eax
mov dword [0x4a2a18], eax
mov eax, dword [0x4a2a18]
mov ecx, 0x4a3f20
mov edi, dword [0x4a2a18]
test eax, eax
cmovne ecx, dword [ebp - 0x1c]
test edi, edi
jne 0x473804
mov eax, dword [ecx + 4]
mov dword [ebx], eax
mov eax, dword [ecx + 8]
mov dword [ebx + 4], eax
mov eax, dword [ecx + 0xc]
mov dword [ebx + 8], eax
movzx eax, word [ecx + 0x114]
mov dword [ebx + 0xc], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x4a3ee0]
cmp eax, dword [ecx + 4]
jle 0x4737fb
push 0x4a3ee0
call fcn.0047ecf6
add esp, 4
cmp dword [0x4a3ee0], 0xffffffff
jne 0x4737fb
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], edi
push eax
push 0x20119
xor esi, esi
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4737d5
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], 4
push eax
lea eax, [ebp - 0x20]
push eax
push edi
push 0x49ddf4
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
test esi, esi
je 0x4737e9
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1c]
push 0x4a3ee0
mov dword [0x4a3ee4], eax
call fcn.0047ecac
add esp, 4
mov ecx, dword [0x4a3ee4]
mov dword [ebx + 0x10], ecx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401686
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404474], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4041cf], ebp
mov dword [0x404404], eax
mov dword [0x4041c7], eax
mov dword [0x4043f0], 0x30
mov dword [0x4043f4], 2
jmp 0x4016c6
mov dword [0x4043f8], 0x403051
mov dword [0x4043fc], 0
mov dword [0x404400], 0
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x40440c], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x404408], eax
mov dword [0x40441c], eax
mov dword [0x404418], 0x40439a
mov dword [0x404410], 0xf
push 0x4043f0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4041c7]
push 0
push 0
push 0x1e0
push 0x1fe
push 0xfffff862
push 0xfffff8f8
push 0xcf0000
push 0x4043e7
push str.lunt
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404468], eax
push 5
push dword [0x404468]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404468]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404420]
jmp 0x40179a
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x40178c
mov eax, dword [0x404428]
jmp 0x4017b5
call 0x402a06
ret

Function at 0x43b649
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
sub ecx, 0x23bad017
call fcn.0043b686
dec ecx
and ecx, ecx
xor dword [edx], ebx
or ecx, eax
add ecx, 0x5499e934
mov ecx, eax
inc edx
mov eax, ecx
cmp edx, edi
jne fcn.0043b649
add ecx, 0x32e7e4ef
sub ecx, 0xdd3e1ac5
or eax, eax
ret
Function at 0x43b179
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push edi
call dword [0x44b0f8]
mov esi, eax
test esi, esi
jne 0x43b1cd
call dword [0x44b0f4]
mov edi, eax
test edi, edi
jle 0x43b1a4
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x43b1ab
mov edi, 0x80004005
push edi
push 0x140
push 0x44ee0c
call fcn.00433792
push 0x44f204
push edi
call 0x4701a8
pop ecx
pop ecx
jmp 0x43b31a
mov eax, 0x5a4d
cmp ax, word [esi]
je 0x43b1f6
mov esi, 0x8007000d
push esi
push 0x14a
push 0x44ee0c
mov edi, esi
call fcn.00433792
push 0x44ee88
push esi
jmp 0x43b1c1
mov ecx, dword [esi + 0x3c]
cmp dword [ecx + esi], 0x4550
je 0x43b220
mov esi, 0x8007000d
push esi
push 0x155
push 0x44ee0c
mov edi, esi
call fcn.00433792
push 0x44eef8
jmp 0x43b1f3
movzx eax, word [ecx + esi + 0x14]
push ebx
add eax, ecx
lea ebx, [esi + 0x18]
push 8
add ebx, eax
push 0x44f01c
push ebx
call 0x45fafa
add esp, 0xc
test eax, eax
je 0x43b265
mov eax, dword [esi + 0x3c]
movzx ecx, word [eax + esi + 6]
xor eax, eax
inc eax
cmp eax, ecx
jae 0x43b28c
add ebx, 0x28
inc eax
cmp dword [ebx], 0x7869772e
jne 0x43b24c
cmp dword [ebx + 4], 0x6e727562
jne 0x43b24c
cmp dword [ebx + 0x10], 0x34
jae 0x43b2aa
mov esi, 0x8007000d
push esi
push 0x17a
push 0x44ee0c
mov edi, esi
call fcn.00433792
push dword [ebx + 0x10]
push 0x44f048
jmp 0x43b2d4
mov esi, 0x8007000d
push esi
push 0x16e
push 0x44ee0c
mov edi, esi
call fcn.00433792
push 0x44f028
jmp 0x43b311
mov ebx, dword [ebx + 0xc]
add ebx, esi
cmp dword [ebx + 4], 2
je 0x43b2df
mov esi, 0x8007000d
push esi
push 0x184
push 0x44ee0c
mov edi, esi
call fcn.00433792
push dword [ebx + 4]
push 0x44f0ec
push esi
call 0x4701a8
add esp, 0xc
jmp 0x43b319
mov edx, dword [ebp + 8]
mov ecx, edi
mov eax, dword [edx + ecx*4]
cmp eax, dword [ebx + ecx*4 + 8]
jne 0x43b2f5
inc ecx
cmp ecx, 4
jne 0x43b2e4
jmp 0x43b319
mov esi, 0x8007000d
push esi
push 0x18a
push 0x44ee0c
mov edi, esi
call fcn.00433792
push 0x44f22c
push esi
call 0x4701a8
pop ecx
pop ecx
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x343a785a
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x15a5188f
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
jmp 0x431219