joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4033c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x414020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40345c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40343c
xor eax, eax
push ebp
push 0x403435
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403478
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40343c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x414020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x414020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403ee4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x415044], 0
je 0x403f45
cmp word [0x415218], 0xd7b2
jne 0x403f0d
cmp dword [0x415220], 0
jbe 0x403f0d
mov eax, 0x415214
call dword [0x415230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x41406c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403f6c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41402c], 0
jne 0x403f61
push 0
push 0x414064
push 0x41406c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x40514c
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40537c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4051cf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40537c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4051cf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405398
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405258
xor eax, eax
push ebp
push 0x405251
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404f94
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405236
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4053b8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405236
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405258
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405372
cmp byte [ebp - 0xd], 0
jne 0x40529f
cmp byte [ebp - 0x12], 0
je 0x405372
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4052b8
dec ebx
cmp byte [ebx], 0x2e
je 0x4052c7
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4052b7
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405372
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405304
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405372
cmp byte [ebp - 0xd], 0
je 0x405372
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405372
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405258
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40537c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4051cf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40537c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4051cf
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405398
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x405258
xor eax, eax
push ebp
push 0x405251
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00404f94
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405236
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4053b8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405236
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405258
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405372
cmp byte [ebp - 0xd], 0
jne 0x40529f
cmp byte [ebp - 0x12], 0
je 0x405372
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4052b8
dec ebx
cmp byte [ebx], 0x2e
je 0x4052c7
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4052b7
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405372
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405304
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405372
cmp byte [ebp - 0xd], 0
je 0x405372
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x405372
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405a08
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405a6e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004042d0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402e5c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405a58
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405a75
lea eax, [ebp - 0x10]
call fcn.00404060
ret

Function at 0x40ac4c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40ac85
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404150
jmp 0x40ac8e
mov eax, ebx
mov edx, esi
call fcn.004040b4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40ac98
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40acb9
mov al, byte [esp]
jmp 0x40acbb
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b340
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b1b8
mov eax, dword [0x41456c]
cmp byte [eax], 0
je 0x40b3bc
mov eax, dword [0x414490]
call fcn.00402bc4
call fcn.0040275c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408600
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b404
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b3f2
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x41446c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x415660]
call fcn.00404f58
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40c0a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40c104
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004042d0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004081c0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c10b
lea eax, [ebp - 0xc]
call fcn.00404060
ret
Function at 0x401000
Capabilities:
Copy file

Disassembly:
sub esp, 0x410
mov eax, dword [esp + 0x414]
push ebx
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x110]
push ecx
push ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea edx, [esp + 0x10]
push ebx
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 0x118]
push eax
push ecx
mov byte [esp + 0x1c], bl
mov word [esp + 0x1d], bx
call fcn.00401241
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x225]
mov byte [esp + 0x224], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x406038
lea edx, [esp + 0x24]
push str.GdiPlus
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x230]
push eax
push ecx
call fcn.004011b0
lea edx, [esp + 0x34]
push 0x5c
push edx
call fcn.00401150
add esp, 0x30
cmp eax, ebx
je 0x4010ce
mov byte [eax], bl
lea eax, [esp + 0xc]
push 0x5c
push eax
call fcn.00401150
add esp, 8
cmp eax, ebx
je 0x4010e3
mov byte [eax], bl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x315]
mov byte [esp + 0x314], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x406038
lea ecx, [esp + 0x10]
stosb byte es:[edi], al
push str.GdiPlus
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x320]
push edx
push eax
call fcn.004011b0
add esp, 0x14
lea ecx, [esp + 0x210]
lea edx, [esp + 0x314]
push ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop edi
xor eax, eax
pop ebx
add esp, 0x410
ret 0x10

Function at 0x43b654
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x43b3c1
sub esi, 0xa91a8838
sub esi, 0x6e254264
call fcn.0043b68d
mov esi, esi
inc ebx
and ebx, ebx
xor dword [eax], edx
add ebx, esi
inc esi
sub ebx, ebx
inc eax
push esi
pop ebx
mov esi, esi
add ebx, 0xde711b9b
cmp eax, ecx
jne fcn.0043b654
add esi, 0x58c80f52
ret
Function at 0x40545e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40546d
pop dword [ebp - 0x34]
mov eax, 0x945a39e4
sub eax, 0x9419e577
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xe5f4e176
add dword [ebp - 0x44], 0x685d63d5
mov dword [ebp - 0x40], 0x33fe64e2
sub dword [ebp - 0x40], 0x1cb189d
mov dword [ebp - 0x3c], 0xed145d62
sub dword [ebp - 0x3c], 0xa0c81934
mov dword [ebp - 0x38], 0xe667230
sub dword [ebp - 0x38], 0xe667230
lea eax, [ebp - 0x44]
push eax
mov eax, 0x54e00699
add eax, 0xab6229db
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x3c8dae42
add dword [ebp - 0x44], 0x37e4bb14
mov dword [ebp - 0x40], 0x5538a2be
add dword [ebp - 0x40], 0xec33beb7
mov dword [ebp - 0x3c], 0xb1144de6
sub dword [ebp - 0x3c], 0x4da4e17a
mov dword [ebp - 0x38], 0x952f4d56
add dword [ebp - 0x38], 0x6ad0b2aa
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x42013
push 0
call eax
mov ecx, 0x58aa
mov esi, eax
mov edi, 0x434400
add edi, dword [ebp - 0x34]
mov edx, 0xa843b307
sub dword [ebp - 0xc], ecx
mov ebx, dword [edi]
xor dword [ebp - 0x20], 0xe143c35f
sub ebx, edx
xor dword [ebp - 0x30], edx
mov dword [esi], ebx
xor dword [ebp - 0x1c], 0x16a9cc61
add esi, 0x7eec99c4
sub esi, 0x7eec99c0
add edi, 4
loop 0x405578
add eax, 0xea623aa0
sub eax, 0xea60e525
xor ebx, ebx
add ebx, eax
add eax, 0x5bdd4431
sub eax, 0x5bdd442c
mov ecx, 0x8a84efb
add ecx, 0xf797b105
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x40319c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x4031ab
pop dword [ebp - 0x48]
mov eax, 0x4031ab
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x5327a
push 0
mov eax, 0x1147a6a7
add eax, 0xeefd0c09
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x5404
xor edi, edi
add edi, eax
mov edx, 0x5414e77c
sub edx, 0x53cc597c
add edx, dword [ebp - 0x48]
mov esi, 0xe6049dea
add esi, 0x55c79255
mov ebx, dword [edx]
add dword [ebp - 0x28], 0x46272ebe
xor ebx, esi
add dword [ebp - 0x2c], edi
mov dword [edi], ebx
xor dword [ebp - 0x38], 0xeaefabe6
add edi, 4
add edx, 4
loop 0x403201
add eax, 0x142e3
xor ebx, ebx
add ebx, eax
add eax, 0x4a9b27ca
sub eax, 0x4a9b27c5
mov ecx, 0x5f8f7297
sub ecx, 0x5f4f7297
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x408956
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
or edi, ecx
add edi, 0x23b98d3e
call fcn.00408978
sub ecx, ecx
xor dword [esi], ebx
dec ecx
mov edi, edi
inc esi
cmp esi, edx
jne fcn.00408956
sub ecx, edi
ret
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x5c5f0d90
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x512f2818
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401db0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
not eax
push esi
mov esi, dword [ebp + 0x10]
push edi
test dl, 3
je 0x401de2
test esi, esi
je 0x401de2
movzx ecx, byte [edx]
dec esi
xor ecx, eax
inc edx
movzx ecx, cl
shr eax, 8
xor eax, dword [ecx*4 + 0x578018]
test dl, 3
jne 0x401dc5
mov edi, esi
and edi, 0xfffffff0
add edi, edx
cmp edx, edi
jae 0x401ed7
xor eax, dword [edx]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x578018]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x578018]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x578018]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x578018]
xor eax, dword [edx + 4]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x578018]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x578018]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x578018]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x578018]
xor eax, dword [edx + 8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x578018]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x578018]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x578018]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x578018]
xor eax, dword [edx + 0xc]
add edx, 0x10
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x578018]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x578018]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x578018]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x578018]
cmp edx, edi
jb 0x401df1
and esi, 0xf
xor edi, edi
push ebx
xor ebx, ebx
lea ecx, [esi + edx]
cmp edx, ecx
cmova esi, ebx
pop ebx
test esi, esi
je 0x401f0a
nop dword [eax]
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
inc edi
movzx ecx, cl
shr eax, 8
xor eax, dword [ecx*4 + 0x578018]
cmp edi, esi
jb 0x401ef0
pop edi
not eax
pop esi
pop ebp
ret
Function at 0x404270
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
test edi, edi
je 0x404364
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x404364
mov esi, dword [ebp + 0x10]
test esi, esi
jle 0x404364
lea eax, [ebp - 4]
push eax
call fcn.00404190
add esp, 4
mov dword [ebp - 8], eax
lea eax, [esi - 1]
mov dword [ebp + 8], eax
push 0
push ebx
push eax
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xe
add esi, 0xfffffff2
cmp dword [0x585748], 0
je 0x404321
lea eax, [ebp - 0x2c]
push eax
call fcn.00404210
add esp, 4
cmp word [ebp - 0x2c], 9
jne 0x4042f9
mov dword [0x593d90], 1
jmp 0x404302
cmp dword [0x593d90], 0
je 0x404317
push 0x103
push 0x593c88
push str._SystemRoot_SysWOW64
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [0x585748], 0
cmp byte [0x593c88], 0
je 0x40434a
push 0
push ebx
push dword [ebp + 8]
push 0
push edi
push 0x593c88
call dword [sym.imp.KERNEL32.dll_SearchPathA]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xe
add esi, 0xfffffff2
cmp dword [ebp - 8], 0
je 0x40435b
push dword [ebp - 4]
call fcn.004041d0
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffffea
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405b40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x405b55
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x405b96
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x405b92
nop word [eax + eax]
cmp esi, edx
jae 0x405b96
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x405b80
cmp esi, edx
jb 0x405b9b
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret