joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462642
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x224
mov eax, dword [0x4adadc]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0x105
push eax
push str.SoftwareSimonTathamPuTTY
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov edi, dword [esp + 0x234]
xor ebx, ebx
test eax, eax
jne 0x4626df
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x128]
push eax
lea eax, [esp + 0x20]
push eax
push ebx
push str.RandSeedFile
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4626df
cmp dword [esp + 0x18], 1
jne 0x4626df
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x128]
push edi
push eax
call fcn.004631d6
add esp, 0xc
test al, al
je 0x4626df
mov eax, dword [esp + 0xc]
jmp 0x46284b
cmp byte [0x4b1c78], bl
jne 0x462719
push str.shell32.dll
call fcn.0045e226
mov dword [0x4b1c7c], eax
pop ecx
test eax, eax
je 0x462709
push str.SHGetFolderPathA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x46270b
mov eax, ebx
mov dword [0x4b1c80], eax
mov byte [0x4b1c78], 1
jmp 0x46271e
mov eax, dword [0x4b1c80]
push ebp
mov ebp, str.PUTTY.RND
test eax, eax
je 0x462798
lea ecx, [esp + 0x20]
push ecx
push ebx
push ebx
push 0x1c
push ebx
call eax
test eax, eax
js 0x46275e
lea eax, [esp + 0x10]
push eax
push edi
push ebx
lea eax, [esp + 0x2c]
push ebp
push eax
call fcn.0044dbed
add esp, 0xc
push eax
call fcn.00463270
add esp, 0xc
test al, al
jne 0x462841
lea eax, [esp + 0x20]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [0x4b1c80]
test eax, eax
js 0x462798
lea eax, [esp + 0x10]
push eax
push edi
push ebx
lea eax, [esp + 0x2c]
push ebp
push eax
call fcn.0044dbed
add esp, 0xc
push eax
call fcn.00463270
add esp, 0xc
test al, al
jne 0x462841
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [esp + 0x128]
mov ebp, 0x104
push ebp
push eax
push str.HOMEDRIVE
call esi
mov ebx, eax
lea eax, [esp + 0x20]
push ebp
push eax
push str.HOMEPATH
call esi
test ebx, ebx
jne 0x4627cf
mov byte [esp + 0x128], bl
jmp 0x4627d3
cmp ebx, ebp
jae 0x46280a
dec eax
cmp eax, 0x102
ja 0x46280a
lea eax, [esp + 0x10]
push eax
push edi
push 0
push str.PUTTY.RND
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x13c]
push eax
call fcn.0044dbed
add esp, 0x10
push eax
call fcn.00463270
add esp, 0xc
test al, al
jne 0x462841
push ebp
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp eax, ebp
jae 0x462847
lea eax, [esp + 0x10]
push eax
push edi
push 0
lea eax, [esp + 0x2c]
push str.PUTTY.RND
push eax
call fcn.0044dbed
add esp, 0xc
push eax
call fcn.00463270
add esp, 0xc
test al, al
je 0x462847
mov eax, dword [esp + 0x10]
jmp 0x46284a
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004659d6
add esp, 0x224
ret
Function at 0x462876
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x110
mov eax, dword [0x4adadc]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push ebp
push edi
push 0
call fcn.00462642
pop ecx
call fcn.0045d784
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [esp + 0xc]
push eax
push str.SoftwareSimonTathamPuTTY
mov ebp, 0x80000001
push ebp
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4628cc
push dword [esp + 0xc]
call fcn.00462ee6
pop ecx
push dword [esp + 0xc]
call edi
lea eax, [esp + 0xc]
push eax
push str.SoftwareSimonTatham
push ebp
call ebx
test eax, eax
jne 0x462938
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push esi
push str.PuTTY
push dword [esp + 0x14]
call ebp
push 0x105
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push dword [esp + 0x10]
mov esi, eax
call edi
test esi, esi
pop esi
je 0x462938
lea eax, [esp + 0xc]
push eax
push str.Software
push 0x80000001
call ebx
test eax, eax
jne 0x462938
push str.SimonTatham
push dword [esp + 0x10]
call ebp
push dword [esp + 0xc]
call edi
mov ecx, dword [esp + 0x118]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004659d6
add esp, 0x110
ret

Function at 0x462980
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push str.SoftwareSimonTathamPuTTYSessions
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4629d4
push esi
call fcn.0044e1ae
mov esi, eax
push esi
push dword [ebp + 8]
call fcn.0045de57
pop ecx
pop ecx
push dword [esi]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push esi
call fcn.0044e182
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 8]
call fcn.0045d9f6
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4629d8
Capabilities:
Query or enumerate registry key

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0
mov eax, 0x105
push 1
push eax
mov dword [esp + 0x1c], eax
call fcn.0040dbd9
mov esi, dword [esp + 0x24]
add esp, 0xc
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, eax
push dword [esp + 0x10]
push edi
push dword [esi + 4]
push dword [esi]
call ebx
mov ebp, 0xea
jmp 0x462a38
push 0
push 1
push dword [esp + 0x18]
lea eax, [esp + 0x1c]
push 1
push eax
push edi
call fcn.0040dac4
add esp, 0x18
mov edi, eax
push dword [esp + 0x10]
push edi
push dword [esi + 4]
push dword [esi]
call ebx
cmp eax, ebp
je 0x462a12
test eax, eax
sete bl
test eax, eax
jne 0x462a51
push dword [esp + 0x1c]
push edi
call fcn.0045e3b3
pop ecx
pop ecx
inc dword [esi + 4]
push edi
call fcn.0040dab8
pop ecx
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret
Function at 0x462c67
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x408
mov eax, dword [0x4adadc]
xor eax, esp
mov dword [esp + 0x404], eax
push ebx
mov ebx, dword [esp + 0x410]
push esi
push 1
call fcn.00462642
mov esi, eax
pop ecx
cmp esi, 0xffffffff
je 0x462ccf
push ebp
mov ebp, 0x400
jmp 0x462caf
cmp dword [esp + 0xc], 0
je 0x462cc7
push dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
call ebx
pop ecx
pop ecx
push 0
lea eax, [esp + 0x10]
push eax
push ebp
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x462c9b
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
mov ecx, dword [esp + 0x40c]
pop esi
pop ebx
xor ecx, esp
call fcn.004659d6
add esp, 0x408
ret

Function at 0x462e41
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x462edf
lea eax, [esp + 0x14]
push eax
push 0
lea eax, [esp + 0x14]
push eax
push 0
push dword [esp + 0x28]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x462edf
cmp dword [esp + 0xc], 1
jne 0x462edf
mov ebp, dword [esp + 0x14]
push eax
inc ebp
push 1
push ebp
call fcn.0040dbd9
add esp, 0xc
mov esi, eax
lea eax, [esp + 0x14]
push eax
push esi
lea eax, [esp + 0x14]
push eax
push 0
push dword [esp + 0x28]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x462ed8
cmp dword [esp + 0xc], 1
jne 0x462ed8
mov eax, dword [esp + 0x14]
cmp eax, ebp
jb 0x462ed0
push 0x92
push str...windowswinstore.c
push str.size___allocsize
call fcn.0046a02e
mov eax, dword [esp + 0x20]
add esp, 0xc
mov byte [esi + eax], 0
mov eax, esi
jmp 0x462ee1
push esi
call fcn.0040dab8
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ecx
ret

Function at 0x462ee6
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x4adadc]
xor eax, ebp
mov dword [ebp + 0x8c], eax
push ebx
push esi
mov esi, dword [ebp + 0x98]
mov ebx, 0x105
jmp 0x462f40
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x462f35
push dword [ebp - 0x80]
call fcn.00462ee6
pop ecx
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push ebx
lea eax, [ebp - 0x7c]
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x462f10
mov ecx, dword [ebp + 0x8c]
pop esi
xor ecx, ebp
pop ebx
call fcn.004659d6
lea esp, [ebp + 0x90]
pop ebp
ret
Function at 0x462f7a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call fcn.0044e1ae
push dword [ebp + 0x10]
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.00462af6
add esp, 0x10
lea eax, [ebp - 4]
push eax
push str.SoftwareSimonTathamPuTTYSshHostKeys
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x462fd6
push dword [ebp + 0x14]
call fcn.0046a0b0
pop ecx
inc eax
push eax
push dword [ebp + 0x14]
push 1
push 0
push dword [esi]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.0044e182
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x462fe2
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push ebx
xor ebx, ebx
push ebx
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str.SoftwareSimonTathamPuTTYJumplist
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x463012
push 2
pop eax
jmp 0x4631d1
push ebp
push esi
push edi
push ebx
mov eax, 0xc8
push 1
push eax
mov dword [esp + 0x20], eax
call fcn.0040dbd9
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 0xc
mov esi, eax
mov ebp, str.Recent_sessions
lea eax, [esp + 0x14]
push eax
push esi
lea eax, [esp + 0x20]
push eax
push ebx
push ebp
push dword [esp + 0x24]
call edi
cmp eax, 0xea
jne 0x46307b
push esi
call fcn.0040dab8
push ebx
push 1
push dword [esp + 0x20]
call fcn.0040dbd9
add esp, 0x10
mov esi, eax
lea eax, [esp + 0x14]
push eax
push esi
lea eax, [esp + 0x20]
push eax
push ebx
push ebp
push dword [esp + 0x24]
call edi
cmp eax, 2
je 0x4630b3
test eax, eax
jne 0x46309a
cmp dword [esp + 0x18], 7
je 0x4630b6
push ebp
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x4630b3
push esi
call fcn.0040dab8
pop ecx
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
pop eax
jmp 0x4631ce
mov word [esi], bx
mov edx, dword [esp + 0x14]
mov ecx, esi
sub edx, 1
je 0x4630d3
mov eax, ebx
cmp byte [ecx], bl
jne 0x4630cd
cmp byte [eax + esi + 1], bl
je 0x4630d3
inc ecx
inc eax
cmp eax, edx
jb 0x4630c3
sub ecx, esi
cmp ecx, edx
jb 0x4630dc
mov word [esi], bx
cmp dword [esp + 0x24], ebx
jne 0x4630f0
cmp dword [esp + 0x28], ebx
je 0x4631a4
mov eax, ebx
jmp 0x4630fb
push dword [esp + 0x24]
call fcn.0046a0b0
pop ecx
inc eax
add eax, dword [esp + 0x14]
push ebx
push 1
push eax
call fcn.0040dbd9
add esp, 0xc
mov dword [esp + 0x1c], eax
mov edi, eax
mov ebp, esi
cmp dword [esp + 0x24], ebx
je 0x46312f
push dword [esp + 0x24]
push eax
call fcn.0046e7d0
push edi
call fcn.0046a0b0
inc edi
add esp, 0xc
add edi, eax
cmp byte [esi], bl
je 0x46317c
cmp dword [esp + 0x28], ebx
je 0x463149
push dword [esp + 0x28]
push ebp
call fcn.0046e740
pop ecx
pop ecx
test eax, eax
je 0x46316d
push ebp
call fcn.00462b1c
pop ecx
test eax, eax
je 0x46316d
push eax
call fcn.00462950
push ebp
push edi
call fcn.0046e7d0
push edi
call fcn.0046a0b0
inc edi
add esp, 0x10
add edi, eax
push ebp
call fcn.0046a0b0
inc ebp
add ebp, eax
pop ecx
cmp byte [ebp], bl
jne 0x463133
mov ebp, dword [esp + 0x1c]
mov byte [edi], bl
sub edi, ebp
inc edi
push edi
push ebp
push 7
push ebx
push str.Recent_sessions
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov ebx, eax
call fcn.0040dab8
pop ecx
mov esi, ebp
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4631b4
test ebx, ebx
jne 0x4631b4
mov dword [eax], esi
jmp 0x4631bb
push esi
call fcn.0040dab8
pop ecx
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg ebx
sbb ebx, ebx
and ebx, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4631d6
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push esi
test ecx, ecx
jne 0x46321e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x463214
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x463214
call esi
push eax
call fcn.0045e42b
push eax
push dword [ebp + 8]
push str.Unable_to_delete__s:__s
call fcn.0045aeaf
add esp, 0x10
mov eax, dword [ebp + 0x10]
or dword [eax], 0xffffffff
xor al, al
jmp 0x46326d
push 0
push 2
pop esi
xor eax, eax
mov edx, 0x80
cmp ecx, esi
cmove eax, edx
push eax
xor eax, eax
cmp ecx, esi
setne al
xor edx, edx
add eax, esi
cmp ecx, esi
push eax
push 0
push 3
pop eax
cmove eax, edx
mov edx, 0x40000000
push eax
mov eax, 0x80000000
cmove eax, edx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp + 0x10]
mov edx, eax
xor eax, eax
cmp edx, 0xffffffff
setne al
mov dword [ecx], edx
pop esi
pop ebp
ret

Function at 0x4634cc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
call fcn.00462642
mov esi, eax
pop ecx
cmp esi, 0xffffffff
je 0x4634fa
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x477029
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00476f2e

Function at 0x4792b3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00479132

Function at 0x47e44a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047e10a
Function at 0x615eb7c7
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.615eb71c
mov eax, 0x61510000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x615eb83a
cmp dword [ebp - 0x94], 5
jb 0x615eb85b
jmp 0x615eb857
cmp dword [ebp - 0x88], 1
jne 0x615eb85b
cmp dword [ebp - 0x94], 4
ja 0x615eb857
jne 0x615eb85b
cmp dword [ebp - 0x90], 0
jbe 0x615eb85b
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x615f975c
call fcn.615eb5d1
test eax, eax
jge 0x615eb87c
mov byte [0x6161d300], 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.615e06c0
leave
ret
Function at 0x4020be
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x91c
mov eax, esp
mov dword [ebp - 0x8dc], eax
mov dword [ebp - 0x8e], 0x330056
mov dword [ebp - 0x8a], 0x530044
mov dword [ebp - 0x86], 0x6f0043
mov dword [ebp - 0x82], 0x46006d
mov dword [ebp - 0x7e], 0x6e0069
mov dword [ebp - 0x7a], 0x650064
mov dword [ebp - 0x76], 0x430072
mov dword [ebp - 0x72], 0x61006c
mov dword [ebp - 0x6e], 0x730073
mov word [ebp - 0x6a], 0
lea edx, [ebp - 0xc0]
mov eax, 0
mov ecx, 0xc
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc0], 0x30
mov dword [ebp - 0xbc], 3
mov dword [ebp - 0xb8], 0x401520
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb0], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xac], eax
mov dword [esp + 4], 0x7f89
mov dword [esp], 0
mov eax, dword [0x40d50c]
call eax
sub esp, 8
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], 6
mov dword [ebp - 0x9c], 0
lea eax, [ebp - 0x8e]
mov dword [ebp - 0x98], eax
mov dword [esp + 4], 0x65
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [0x40d510]
call eax
sub esp, 8
mov dword [ebp - 0x94], eax
mov dword [esp + 4], 0x65
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [0x40d510]
call eax
sub esp, 8
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0xc0]
mov dword [esp], eax
mov eax, dword [0x40d520]
call eax
sub esp, 4
test ax, ax
jne 0x402238
mov dword [esp + 0xc], 0x30
mov dword [esp + 8], str.Error
mov dword [esp + 4], str.Window_Registration_Failed_
mov dword [esp], 0
mov eax, dword [0x40d514]
call eax
sub esp, 0x10
mov eax, 0
jmp 0x402c05
mov dword [esp], 0
mov eax, dword [0x40d500]
call eax
sub esp, 4
mov dword [0x40c7f4], eax
mov dword [esp], 1
mov eax, dword [0x40d500]
call eax
sub esp, 4
mov dword [0x40c7f8], eax
mov dword [0x40c7fc], 0x1d6
mov dword [0x40c800], 0x10e
mov eax, dword [0x40c7f4]
mov edx, dword [0x40c7fc]
sub eax, edx
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
mov dword [0x40c804], eax
mov eax, dword [0x40c7f8]
mov edx, dword [0x40c800]
sub eax, edx
mov edx, eax
shr edx, 0x1f
add eax, edx
sar eax, 1
mov dword [0x40c808], eax
jmp fcn.0077ec92
mov esp, dword [ebp - 0x8dc]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
Function at 0x905a30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x79f015
lea edi, [esi - 0x39e015]
push edi
or ebp, 0xffffffff
jmp 0x905a52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x905a59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x905a48
mov eax, 1
add ebx, ebx
jne 0x905a6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x905a7c
jne 0x905a9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x905a9b
dec eax
add ebx, ebx
jne 0x905a88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x905a60
add ebx, ebx
jne 0x905a97
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x905aed
xor ecx, ecx
sub eax, 3
jb 0x905ab3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x905b22
sar eax, 1
mov ebp, eax
jmp 0x905abe
add ebx, ebx
jne 0x905abe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x905a8c
inc ecx
add ebx, ebx
jne 0x905acc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x905a8c
add ebx, ebx
jne 0x905ad9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x905ace
jne 0x905aea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x905ace
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x905b0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x905afe
jmp 0x905a4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x905b0c
add edi, ecx
jmp 0x905a4e
pop esi
mov edi, esi
mov ecx, 0x90d6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x905b2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x905b2f
lea edi, [esi + 0x503000]
mov eax, dword [edi]
or eax, eax
je 0x905b97
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x505000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x505078]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x905b55
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x50507c]
or eax, eax
je 0x905b91
mov dword [ebx], eax
add ebx, 4
jmp 0x905b72
call dword [esi + 0x50508c]
mov ebp, dword [esi + 0x505080]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x905bcb
sub esp, 0xffffff80
jmp 0x42c620
Function at 0x9dccd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9dcd1c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9dcce2
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9dcd80
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9dcdd2
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9dcdd8
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0x9f52c5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009f4f85

Function at 0x9fa0bf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009f9f3e

Function at 0x9ff670
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x9ff69d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x9ff69d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, reloc.shlwapi.dll_SHGetValueW
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219