joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5997a2
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x5000fdb0]
add dword [0x5000fd80], eax
cmp byte [0x5000f840], 0
jne 0x599808
cmp dword [0x5000fdb0], 0
jle 0x599808
mov eax, dword [0x5000fdbc]
lea edx, [eax + 0x5002a800]
mov ecx, dword [0x5000fdb0]
mov eax, dword [0x5000f864]
call fcn.00597f9a
test eax, eax
jge 0x599808
mov dword [0x5000f834], 5
push 0x50005b6c
push dword [0x5000f854]
push 0x50005b8c
mov eax, 0x5000f838
mov edx, 3
call fcn.00596f12
ret
mov eax, dword [0x5000fdb0]
test eax, eax
je 0x599844
add dword [0x5000fda0], eax
mov eax, dword [0x5000fdc4]
mov esi, dword [0x5000fdbc]
xor ebx, ebx
mov bl, al
xor bl, byte [esi + 0x5002a800]
shr eax, 8
xor eax, dword [ebx*4 + 0x5000fde4]
inc esi
cmp esi, dword [0x5000fda8]
jb 0x599824
mov dword [0x5000fdc4], eax
cmp dword [0x5000fda8], 0x10000
jb 0x599875
mov esi, 0x5002a800
mov edi, esi
add esi, dword [0x5000fda8]
sub esi, 0x8000
mov ecx, 0x8000
cld
rep movsb byte es:[edi], byte [esi]
mov dword [0x5000fda8], 0x8000
mov eax, dword [0x5000fda8]
mov dword [0x5000fdbc], eax
mov dword [0x5000fdb0], 0
ret

Function at 0x59c61e
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x5000fda8], 0x8000
jle 0x59c683
pushal
mov edx, dword [0x5000fda8]
sub edx, 0x8000
mov esi, 0x5002a800
mov edi, esi
add esi, edx
mov ecx, 0x2000
cld
rep movsd dword es:[edi], dword [esi]
mov ebx, 0xffff
sub dword [ebx*4 + 0x50042b04], edx
dec ebx
jns 0x59c64d
mov esi, edx
shl esi, 2
add esi, 0x50082b44
mov ebx, esi
add ebx, 0x20000
mov edi, 0x50082b44
cld
lodsd eax, dword [esi]
sub eax, edx
stosd dword es:[edi], eax
cmp esi, ebx
jb 0x59c670
popal
mov dword [0x5000fda8], 0x8000
mov eax, dword [0x5000fda8]
mov dword [0x5000fdbc], eax
mov eax, dword [0x5000f91e]
sub eax, dword [0x5000fda0]
mov dword [0x5000fdb0], eax
cmp dword [0x5000fdb0], 0x8000
jle 0x59c6b3
mov dword [0x5000fdb0], 0x8000
mov eax, dword [0x5000fdbc]
lea edx, [eax + 0x5002a800]
mov ecx, dword [0x5000fdb0]
mov eax, dword [0x5000f864]
call fcn.00597fc6
cmp eax, dword [0x5000fdb0]
je 0x59c700
mov dword [0x5000f834], 3
push 0x50008a38
push dword [0x5000f854]
push 0x50008a5c
mov eax, 0x5000f838
mov edx, 3
call fcn.00596f12
ret
mov eax, dword [0x5000fdbc]
add eax, dword [0x5000fdb0]
mov dword [0x5000fda8], eax
mov eax, dword [0x5000fdb0]
add dword [0x5000fda0], eax
mov eax, dword [0x5000fdb0]
add dword [0x5000fd80], eax
pushal
mov eax, dword [0x5000fdc4]
mov esi, dword [0x5000fdbc]
xor ebx, ebx
mov bl, al
xor bl, byte [esi + 0x5002a800]
shr eax, 8
xor eax, dword [ebx*4 + 0x5000fde4]
inc esi
cmp esi, dword [0x5000fda8]
jb 0x59c734
mov dword [0x5000fdc4], eax
popal
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x46e0481
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x44da455e
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x40c850
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x533290
push 0x4d1380
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x53c948]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov byte [ebp - 0x19], 0
cmp dword [ebp + 0x14], 0
je 0x40ca08
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40ca08
cmp byte [eax], 0
je 0x40ca08
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40ca08
cmp byte [eax], 0
je 0x40ca08
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x40ca08
cmp dword [ebp + 0x18], 0
je 0x40ca08
push eax
call dword [0x4fc1d0]
test eax, eax
je 0x40ca08
push 0
push 0x40
push ebx
call fcn.0040cbe0
add esp, 0xc
test al, al
je 0x40ca08
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x40ca08
mov edi, dword [ebx + 0x3c]
add edi, ebx
push 0
push pe_nt_image_headers32
push edi
call fcn.0040cbe0
add esp, 0xc
test al, al
je 0x40ca08
cmp dword [edi], 0x4550
jne 0x40ca08
mov esi, dword [edi + 0x80]
add esi, ebx
cmp esi, edi
jne 0x40c949
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c950
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0xc]
test eax, eax
je 0x40c980
add eax, ebx
push edi
mov ecx, dword [ebp + 0xc]
push ecx
push eax
call fcn.0040cde1
add esp, 0xc
test eax, eax
je 0x40c980
add esi, 0x14
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x40c962
cmp dword [esi + 0xc], 0
je 0x40c935
mov esi, dword [esi + 0x10]
add esi, ebx
mov dword [ebp - 0x24], esi
mov eax, dword [esi]
test eax, eax
je 0x40ca08
cmp eax, dword [ebp + 0x18]
jne 0x40ca1d
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x20]
push edx
push 0x80
push 4
push esi
call dword [0x4fc3f4]
test eax, eax
je 0x40ca08
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x14]
push eax
push esi
call dword [0x4fc1b8]
mov byte [ebp - 0x19], 1
mov dword [ebp - 4], 0xfffffffe
jmp 0x40c9f0
mov dword [ebp - 0x28], 0
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x20]
push edx
push 4
push esi
call dword [0x4fc3f4]
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add esi, 4
jmp 0x40c98b
Function at 0x421a70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f8b28
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x53c948]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x18]
push ecx
mov dword [ebp - 4], 0
mov dword [edi], 0x51c718
mov dword [edi + 0x14], eax
call dword [0x4fc1fc]
push 0x51c6d8
lea ecx, [edi + 4]
call fcn.00414b60
push 0x51c69c
lea ecx, [edi + 4]
call fcn.00414b60
push 0x51c660
lea ecx, [edi + 4]
call fcn.00414b60
push 0x51c624
lea ecx, [edi + 4]
call fcn.00414b60
push 0x80000
call fcn.0041791f
push 0x80000
push 0
push eax
mov dword [edi + 0x30], eax
call fcn.004d1060
add esp, 0x10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x439450
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f138b
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x53c948]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
lea ecx, [esi + 4]
call fcn.00439510
xor edi, edi
mov dword [esi], 0x4feb94
push 0x18
mov dword [ebp - 4], edi
mov dword [esi + 0x30], edi
call fcn.004051aa
add esp, 4
cmp eax, edi
je 0x4394df
mov dword [esi + 0x2c], eax
mov dword [eax], eax
mov eax, dword [esi + 0x2c]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x2c]
mov dword [eax + 8], eax
mov edx, dword [esi + 0x2c]
mov al, 1
mov byte [edx + 0x14], al
mov ecx, dword [esi + 0x2c]
mov byte [ecx + 0x15], al
mov dword [esi + 0x38], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
lea edx, [ebp + 0xc]
push edx
lea ecx, [ebp - 0x1c]
mov dword [ebp + 0xc], edi
call fcn.004d0aea
push 0x52a4e8
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x4fc790
call fcn.004d0c29
int3
Function at 0x44e210
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f1462
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x53c948]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor eax, eax
xor ebx, ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov byte [esi + 0x58], bl
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov eax, dword [0x4fed80]
mov dword [esi + 0x2c], eax
mov ecx, dword [0x4fed84]
mov dword [esi + 0x30], ecx
mov edx, dword [0x4fed88]
mov dword [esi + 0x34], edx
mov eax, dword [0x4fed8c]
mov dword [esi + 0x38], eax
mov dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0x60], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
xor ecx, ecx
mov dword [esi + 0xb0], 7
mov dword [esi + 0xac], ebx
mov word [esi + 0x9c], cx
lea edx, [esi + 0x64]
push edx
mov byte [ebp - 4], 4
call dword [0x4fc1fc]
push ebx
push ebx
push 1
push ebx
call dword [0x4fc1ec]
mov dword [esi + 0x60], eax
cmp eax, ebx
jne 0x44e310
lea ecx, [ebp - 0x20]
call fcn.004d0a51
push 0x52c1e4
lea eax, [ebp - 0x20]
push eax
call fcn.004d0c29
push esi
call fcn.0041f840
mov ecx, eax
call fcn.0044db60
mov dword [esi + 0x5c], eax
cmp eax, ebx
jge 0x44e33a
lea ecx, [ebp - 0x20]
call fcn.004d0a51
push 0x52c1e4
lea ecx, [ebp - 0x20]
push ecx
call fcn.004d0c29
push 0x53fea5
push 0x10010
call fcn.004167dc
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x44e377
push 0x10000
lea edx, [edi + 8]
push ebx
push edx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 0x10008], ebx
mov dword [edi + 0x1000c], ebx
call fcn.004d1060
add esp, 0xc
jmp 0x44e379
xor edi, edi
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 5
cmp edi, ebx
je 0x44e390
push 0x41
push edi
push esi
call fcn.004500d0
add esp, 0xc
push edi
call fcn.00406ed9
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4529c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f243e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x53c948]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], 0x51534c
call fcn.004cfebe
mov dword [ebp - 4], 0
push 4
call fcn.004051aa
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 1
test edi, edi
je 0x452a4f
call fcn.004cf9b5
mov dword [edi], eax
call fcn.004cf774
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.004cf6a9
mov byte [ebp - 4], 2
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x452a41
inc eax
mov dword [ebx + 4], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.004cf6d1
jmp 0x452a51
xor edi, edi
mov byte [ebp - 4], 0
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x475c30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f30cb
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x53c948]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
xor eax, eax
mov dword [esi + 0x20], 7
mov dword [esi + 0x1c], ebx
mov word [esi + 0xc], ax
mov eax, 1
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], eax
lea edi, [esi + 0x4c]
push 8
mov dword [ebp - 4], ebx
mov dword [edi], ebx
call fcn.004051aa
add esp, 4
cmp eax, ebx
je 0x475cde
mov dword [edi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [edi]
mov dword [ecx], edi
xor eax, eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], ebx
call fcn.004d0aea
push 0x52a4e8
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x4fc790
call fcn.004d0c29
int3
Function at 0x4ca400
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fa4b0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x53c948]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
xor ebx, ebx
mov dword [esi], 0x521f10
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov byte [esi + 0x14], 1
mov dword [esi + 0x18], ebx
mov eax, 7
xor ecx, ecx
mov dword [esi + 0x30], eax
mov dword [esi + 0x2c], ebx
mov dword [ebp - 4], ebx
mov word [esi + 0x1c], cx
xor edx, edx
mov dword [esi + 0x4c], eax
mov dword [esi + 0x48], ebx
mov word [esi + 0x38], dx
mov dword [esi + 0x68], eax
xor eax, eax
mov dword [esi + 0x64], ebx
mov word [esi + 0x54], ax
mov eax, 0xf
mov dword [esi + 0x84], eax
mov dword [esi + 0x80], ebx
mov byte [esi + 0x70], bl
mov dword [esi + 0xa0], eax
mov dword [esi + 0x9c], ebx
mov byte [esi + 0x8c], bl
mov dword [esi + 0xbc], eax
mov dword [esi + 0xb8], ebx
mov byte [esi + 0xa8], bl
push 0x521ef4
mov byte [ebp - 4], 6
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd8], ebx
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
mov dword [esi + 0xf8], ebx
call fcn.00426080
add esp, 4
mov dword [esi + 0xf8], eax
cmp eax, ebx
je 0x4ca5c7
push 0xc
call fcn.004051aa
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x4ca567
mov ecx, dword [esi + 0xf8]
push 0x521ee4
push ecx
call dword [0x4fc204]
mov edx, dword [esi + 0xf8]
push 0x521ed0
push edx
mov dword [ebp - 0x10], eax
call dword [0x4fc204]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [edi], 0x521e64
mov dword [edi + 8], eax
jmp 0x4ca569
xor edi, edi
mov ecx, dword [esi + 0xf8]
push 0x521ec0
mov dword [esi + 0xc4], edi
mov edi, dword [0x4fc204]
push ecx
call edi
mov edx, dword [esi + 0xf8]
push 0x521eac
push edx
mov dword [esi + 4], eax
call edi
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
cmp ecx, ebx
je 0x4ca5c7
cmp eax, ebx
je 0x4ca5c7
push ebx
call ecx
test eax, eax
mov eax, esi
js 0x4ca5d3
mov dword [esi + 0xd0], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
mov dword [esi + 0xd0], 3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e4a80
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ecx + 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
xor esi, esi
mov eax, dword [edx + 0x3c]
movzx ecx, word [eax + edx + 6]
add eax, edx
cmp edi, ecx
jae 0x4e4ad0
movzx ecx, word [eax + 0x14]
add ecx, esi
lea eax, [ecx + eax + 0x18]
test eax, eax
je 0x4e4ad0
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x4e4aba
add ecx, edx
cmp ecx, ebx
ja 0x4e4aca
mov ebx, dword [eax + 8]
add ebx, ecx
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
cmp dword [ebp - 4], ebx
ja 0x4e4ad2
inc edi
add esi, 0x28
jmp 0x4e4a91
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401407
Capabilities:
Terminate process

Disassembly:
push ebx
mov eax, 0x1047f
mov ebx, 0x12345678
mov ecx, 0x12345678
mov edx, 0x12345678
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [section..data], eax
jmp loc.0047b432
Function at 0x300696e2
Capabilities:
Create process on windows
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x710
mov eax, dword [0x3002223c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x6b8], ecx
movzx ecx, byte [eax + 0xf]
push edi
push ecx
movzx ecx, byte [eax + 0xe]
push ecx
movzx ecx, byte [eax + 0xd]
push ecx
movzx ecx, byte [eax + 0xc]
push ecx
movzx ecx, byte [eax + 0xb]
push ecx
movzx ecx, byte [eax + 0xa]
push ecx
movzx ecx, byte [eax + 9]
push ecx
movzx ecx, byte [eax + 8]
push ecx
movzx ecx, word [eax + 6]
push ecx
movzx ecx, word [eax + 4]
push ecx
push dword [eax]
lea eax, [ebp - 0x88]
push 0x300224a0
push eax
call fcn.30069691
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0x34
lea eax, [ebp - 0x6ac]
push eax
xor ebx, ebx
mov edi, 0x20019
push edi
push ebx
push 0x30022490
push SysReAllocString
mov word [ebp - 0x394], bx
mov dword [ebp - 0x6ac], ebx
call esi
test eax, eax
jne 0x300698a9
lea eax, [ebp - 0x6a4]
push eax
push edi
push ebx
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x6ac]
mov dword [ebp - 0x6a4], ebx
call esi
test eax, eax
jne 0x30069895
lea eax, [ebp - 0x6b0]
push eax
lea eax, [ebp - 0x6b4]
push eax
push ebx
push ebx
push 0x30022478
push dword [ebp - 0x6a4]
mov dword [ebp - 0x6b0], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x3006982b
cmp dword [ebp - 0x6b0], 4
jne 0x3006982b
cmp dword [ebp - 0x6b4], 1
jne 0x30069814
cmp dword [ebp - 0x6a4], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x300697fd
push dword [ebp - 0x6a4]
call esi
cmp dword [ebp - 0x6ac], ebx
je 0x3006980d
push dword [ebp - 0x6ac]
call esi
xor al, al
jmp 0x30069b52
cmp dword [ebp - 0x6b4], 2
jne 0x3006982b
mov eax, dword [ebp - 0x6b8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x300697e7
lea eax, [ebp - 0x6a8]
push eax
push edi
push ebx
push 0x30022458
push dword [ebp - 0x6a4]
mov dword [ebp - 0x6a8], ebx
call esi
test eax, eax
jne 0x30069881
lea eax, [ebp - 0x6b0]
push eax
lea eax, [ebp - 0x394]
push eax
push ebx
push ebx
push 0x300049c8
push dword [ebp - 0x6a8]
mov dword [ebp - 0x6b0], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x30069881
mov word [ebp - 0x394], bx
cmp dword [ebp - 0x6a8], ebx
je 0x30069895
push dword [ebp - 0x6a8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x6a4], ebx
je 0x300698a9
push dword [ebp - 0x6a4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x6ac], ebx
je 0x300698bd
push dword [ebp - 0x6ac]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
invalid
invalid
popfd
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0xdfb3177
nop
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x3f775432
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219