joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10015be
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1001a50
call fcn.01001754
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x1002378
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1001379
cmp eax, esi
jne 0x100136c
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100137c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001353
xor esi, esi
inc esi
mov eax, dword [0x1002374]
cmp eax, esi
jne 0x100138f
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x10013be
mov eax, dword [0x1002374]
test eax, eax
jne 0x10013b8
mov dword [0x1002374], esi
push 0x10010d0
push 0x10010c4
call fcn.010012b5
pop ecx
pop ecx
test eax, eax
je 0x10013be
jmp 0x10014e2
mov dword [0x1002038], esi
mov eax, dword [0x1002374]
cmp eax, esi
jne 0x10013e2
push 0x10010c0
push 0x10010b8
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1002374], 2
cmp dword [ebp - 0x20], ebx
jne 0x10013ef
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100237c], ebx
je 0x1001410
push 0x100237c
call fcn.010016c9
pop ecx
test eax, eax
je 0x1001410
push ebx
push 2
push ebx
call dword [0x100237c]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x10014e2
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x100147a
cmp cx, bx
je 0x1001435
cmp dword [ebp - 0x1c], ebx
jne 0x100147a
movzx ecx, word [eax]
cmp cx, bx
je 0x100144a
cmp cx, 0x20
ja 0x100144a
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1001435
test byte [ebp - 0x40], 1
je 0x1001456
movzx ecx, word [ebp - 0x3c]
jmp 0x1001459
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x1002034], eax
cmp dword [0x1002028], ebx
jne 0x10014bf
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x100148b
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x100141f
cmp dword [0x1002038], ebx
jne 0x10014cd
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1002034]
jmp 0x10014ee
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01001799
ret
call fcn.010018a1
jmp 0x1001316
Function at 0x666546
Capabilities:
Encode data using base64

Disassembly:
adc edi, 1
ror ecx, 0x66
neg cl
mov dword [esp + ecx - 0x3ce479f], ecx
movzx ecx, byte [esi + ecx*8 - 0x1e723cf8]
call fcn.009572c9
stc

Function at 0x6b99b2
Capabilities:
Encode data using base64

Disassembly:
push 0xa3055a97
inc ecx
xor al, bh
rol al, 1
jmp 0xa36bd0
call fcn.009214ef
jp 0x639199

Function at 0x6c6071
Capabilities:
Encode data using base64

Disassembly:
xor cl, bl
sal word [esp + 9], 0xc6
push 0x7d1c6315
adc cl, 0x29
rol cl, 1
call fcn.0090f87a

Function at 0x6cd488
Capabilities:
Encode data using xor

Disassembly:
push 0x6b8aa1ba
shl dword [esp], 0x8d
adc edi, 1
add cx, si
mov word [edi], cx
push 0x8aa8810f
not dword [esp + 1]
lea esp, [esp + 8]
jmp fcn.00637635
mov ecx, 0x8db78985
jmp 0x9597cb
mov dword [esp], 0xd2af5596
or word [esp + 6], 0xf026
rol dl, 1
push 0xa11fe12b
rol byte [esp + 5], 0xe7
jae 0x947a1b
ret 0x2b68
test cl, 0xf1
ja 0x6cd498
lcall 0x595, 0x4c8b5f1d
push edx
sub eax, 0x52028f15
jae 0x6cd4ac
jns 0x6cd44c
dec ecx
pop edx
jle 0x6cd541
mov eax, dword [0x9c42a3a7]
inc ebp
adc dword [edi], esp
or al, 0x8a
scasd eax, dword es:[edi]
sub al, dh
push edi
push cs
lodsb al, byte [esi]
mov word [edx], gs
or dword [edx - 0x7e3fc518], ebx
into
dec esp
retf 0xc82c
loope 0x6cd4c3
int 0xe7
mov ebp, 0xce50b2c4
pop edi
pop es
jae 0x6cd56d
jmp 0x6cd547
xor eax, 0x9ff8273a
test al, 0xd4
add ch, byte [edi + eax*4 - 0xd5bd7ec]
mov ebp, 0xe4cda31e
lahf
sub byte [edx + esi*8 - 0x325ce143], ah
in al, 0x9f
cmpsb byte [esi], byte es:[edi]
mov edx, 0xfbb582a7
cmp al, 0xf0
push edx
xchg ecx, eax
dec eax
cld
stosd dword es:[edi], eax
sbb dl, 0x9a
pop ebx
jns 0x6cd514
adc al, 0xb6
invalid
sbb eax, 0x131d0427
dec ebx
dec ecx
add byte [ebx + 0x7efa371c], 0x97
mul ebx
jno 0x6cd55b
stc
or ah, byte [edx - 1]
mov edi, dword [edi]
sub eax, 0xfe19e7c
jl 0x6cd4fb
loope 0x6cd56e
in al, 0xab
cmp eax, 0x6bc5bca3
or esi, dword [ebp - 0x66644dee]
and al, 0x4f
mov esp, 0xb50b6bc5
adc dh, byte [edx + 0x4f24999b]
dec edi
jle 0x6cd51f
xchg ebp, eax
loope 0x6cd568
not dword [edi + 0x47]
insb byte es:[edi], dx
das
in al, 0xa3
inc ebp
dec ebp
sbb byte [esi + ebp], 0x57
cmp al, 0xf9
daa
jns 0x6cd563
cmpsd dword [esi], dword es:[edi]
enter 0x2416, 0x1d
test dword [ecx + edx - 0x421306f0], eax
ret 0x7ef1
dec dl
rol word [esp + 8], 0x62
inc dword [esp + 6]
shl dword [esp + 1], 0x6c
neg dl
xor bl, dl
call fcn.006a1b07
call fcn.009d40f9
mov ebp, 0x4a9cdb1d
lea edx, [ebp*2 + 0x108d180a]
mov ebp, dword [esi + ebp - 0x4a9cdb1d]
imul edx, edx
mov dl, byte [esi + edx - 0x5f61820c]
call fcn.0064ed91
btc cx, cx
mov cx, word [edi]
mov si, word [edi + 2]
jae 0x660120
inc sp
mov dword [edi], ebp
call fcn.00667430

Function at 0x6e01a1
Capabilities:
Encode data using xor

Disassembly:
dec ebx
call fcn.006a4aad
cmp ah, byte [edi - 0x1f]
and dword [ebp + 2], ecx
sub al, 0xda
push ds
pop ebx
salc
sbb ebx, esp
fnsave dword [0x7b162968]
ficomp dword [eax + 0x14]
invalid
Function at 0x8d3751
Capabilities:
Encode data using base64

Disassembly:
call fcn.00a26e08
mov edx, 0x94aa9d1f
movzx eax, dl
movzx edx, byte [esi + eax - 0x1f]
lea esi, [esi + eax - 0x1e]
push eax
movsx ebp, ax
add bp, 0xb719
xor dl, bl
inc bp
inc dl
pop eax
neg dl
shr eax, 0x6d
or bp, 0x3914
inc eax
sbb dl, al
xor dl, 0x98
sar bp, 0x62
rol ebp, 0x2a
or eax, ebp
xor bl, dl
btc ax, ax
ror ebp, 0xf5
push eax
mov dword [esp + eax*8 - 0x1df9e018], esi
cwde
cbw
neg al
push ebx
btr ebp, 0xa2
mov ebp, edi
mov ebx, edx
lea edx, [eax*2 - 0x676d1bf0]
sar al, 0xa5
mov edx, ebx
lea eax, [eax + eax*8 + 0x5f152682]
sal edx, 2
push eax
btr eax, 0xab
cbw
mov eax, ebp
add eax, edx
mov dword [ebp - 4], eax
shl word [esp + 2], 0x64
call fcn.00684a08
mov edx, 0x58924717
movsx ecx, dx
inc cx
mov ebp, dword [ecx + edi - 0x4718]
sal dl, 3
sar cx, 0x2b
movzx esi, dl
lea edi, [edi + ecx - 4]
push esi
and cx, 0x38b9
sar esi, cl
or esi, edi
movzx eax, word [esp + edx - 0x589247b8]
lea edi, [eax + ecx*4 + 0x47858b81]
pop eax
jmp 0x90a05f
jbe 0x9a136c
inc ebp
sal word [esp + 0xa], 0x64
xor eax, 0x46908dbb
dec dword [esp + 0xc]
dec edx
jmp 0x635880

Function at 0x8dec47
Capabilities:
Encode data using base64

Disassembly:
pop ebx
mov dword [edi + 4], ecx
mov ebx, 0x130b38a4
not dword [esp + ebx*2 - 0x26167145]
call fcn.0069546f

Function at 0x8e0aed
Capabilities:
Encode data using base64

Disassembly:
adc edi, 4
shrd ax, dx, cl
jmp 0x8f959f
call fcn.008fba18
cmp si, 0xe494
Function at 0x9208aa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
and dword [esp], 0x311fb69a
adc al, dl
push 0x228ac293
mov word [ebp], ax
call fcn.0098414c
pop esi
xchg edx, eax
xor eax, 0x38cdd12f
mov ecx, 0x52c24c2e
pop edi
adc dword ss:[edi], edi
leave
sub eax, 0x706e5928
invalid
or bp, word [edi + ebp + 2]
mov ecx, 0x4d8808ad
bt ecx, ecx
ror ecx, 0x26
mov cl, byte [edi + 4]
push 0x8e1e89bf
dec dword [esp]
jo 0x6739da
adc edi, 3
sal word [esp], 0x24
push 0xf4a77539
call fcn.009bd654
mov eax, 0x6c99338a
mov edx, 0x913644aa
bts eax, edx
movzx ax, byte [ebp + eax - 0x6c99378a]
not dl
not dx
rol edx, 0x75
mov dl, byte [ebp + edx - 0x755226d5]
jb 0x684ad8
mov edi, dword [edi]
call fcn.0091f932
sub ax, ax
neg ax
lea edi, [edi + eax*4 - 0x580001]
movzx eax, byte [edi + eax*8 - 0xb00000]
call fcn.0097fde1
scasd eax, dword es:[edi]
pop esp
pop esi
popal
in eax, dx
out dx, eax
les eax, [esi + 0x759574b0]
mov cl, 0x83
ljmp 0x7774
jb 0x9d5b59
jmp 0x96d551
pushfd
aam 0xe0
aas
dec esp
cli
add dl, byte [ebx - 0x18]
test byte [esi + 0x13ff9146], bl
wait
lds ebx, [ebx - 0x1f2ba742]
aas
wait
mov esi, 0x3fe0d458
dec esp
jb 0x956add
pushfd
cld
pop ebx
aam 0xe0
aas
dec esp
mov ebx, 0x570cd65
jle 0x956a5c
pop esp
jae 0x956a86
invalid
loop 0x956a6d
jns 0x956b06
lcall 0x1c5f, 0x2ab32a29
invalid
mov ebp, eax
jecxz 0x956a91
out 0xd2, eax
pop esi
push edi
mov ah, 6
shl cl, 1
pop es
and dword [ecx], esp
push es
and al, 0x1b
xchg edi, eax
push es
cmp ebp, dword [ebx + edi*4 + 0x72]
pop es
not byte [eax - 0x21]
mov eax, dword [0xe61bca4c]
sbb esp, esi
leave
push ebp
jl 0x956b5a
pushal
wait
sti
jb 0x956aaa
imul ebp, ecx, 0xffd0beb5
mov ch, 0xbe
sar bh, 1
mov eax, 0x718792a8
movzx ebp, ax
mov ax, word [ebp + edi - 0x92a8]
sub ebp, ebp
jno 0x66d97e
dec edi
jg 0x956b9d
scasd eax, dword es:[edi]
add ebx, dword [eax]
sbb ecx, dword [0x60f9558]
dec ebx
jno 0x956b91
mov bl, 3
sbb al, 2
jne 0x956af8
sbb dword [esi], eax
and al, 0xa0
mov al, byte [0x84762325]
scasb al, byte es:[edi]
lcall 0x81cb, 0xa80a1835
shl dword [ebp + 0x50e229d6], 0x6d
push esi
mov byte [0xa661b232], bh
in eax, dx
lcall 0x776f, 0x97514e6a
jmp 0xad3fee49
push 0x4e
push ecx
xchg edi, eax
outsd dx, dword [esi]
ja 0x956b48
out 0x82, al
stosb byte es:[edi], al
lodsb al, byte [esi]
retf
push edx
adc dl, byte gs:[edx]
inc ebp
add byte [edx], 5
and bh, byte [edx]
inc ebp
push 0x2e
adc dword [esi + 0x64], edi
mov gs, word [edx + 0x630beb3a]
mov bh, 0
invalid
mov byte [0xa5cffdca], al
sub dword [eax + 0xe], edi
push cs
mov al, 0x47
sub ch, cl
out dx, al
cmp ecx, edi
cmp cl, byte [edx + ebx*2 + 0x5b]
jg 0x956b72
jmp 0xf9cf59d8
pushfd
add al, 0x32
ja 0x956b58
xor edi, dword [ebp + 0x7327c6df]
push es
std
push ecx
adc dword [edi + 1], edi
or edi, ebx
pop ebp
sbb byte [ebp - 0x23], bh
dec esp
movsd dword es:[edi], dword [esi]
jmp [eax - 0x7b6f0f1a]
and ebx, 0xff
shl dword [esp + 4], 0xd8
push 0xbd16c510
jnp 0x956b1a
mov ebx, dword [ebx*4 + 0x9933c8]
or dword [esp + 8], 0x5f0ea185
shr ecx, 8
call fcn.0096926e
mov word [esi], ax
jmp 0x695519
push 0xc8bd05ac
adc ebp, 1
push 0x16326fab
jmp 0x63bf0e
Function at 0x92804f
Capabilities:
Encode data using base64

Disassembly:
sar dword [esp + 4], 0x9c
rol dl, 1
ror word [esp + 1], 0xcd
dec dl
xor bl, dl
sar dword [esp + 1], 0xac
lea edx, [esp + edx + 8]
mov dword [edx], ecx
push 0x708f3904
lea esp, [esp + 0xc]
jns fcn.006664d0
mov dword [esp], 0xdb0481b9
inc dl
jmp 0x657ea7

Function at 0x99e659
Capabilities:
Encode data using base64

Disassembly:
inc cl
jmp 0xa23a25
jmp 0x9be3fc
sub cl, 0xbb
mov dword [esp + 4], 0x2d3da914
xor cl, 0xa5
jmp 0x6508b8

Function at 0x9cfb98
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x618ea30e
mov word [edi], dx
call fcn.0067c0b1
lodsd eax, dword [esi]
test byte [ecx + edi*4 + 0x55], al
adc eax, 0x83545073
fnstenv [0xda10ab39]
scasd eax, dword es:[edi]
imul ebp, dword [edi - 0x7f79aec8], 0xffffff81
lahf
js 0x9cfc16
or al, 0xc0
inc ebp
mov cl, 7
aas
push ds
cmp eax, esi
pop edx
push eax
pop edi
cmp cl, dl
pop edi
pop esp
xchg dword [ebp + 0x26f0768f], eax
retf
clc
nop
mov edi, 0x9056daeb
fimul dword [edi - 0x4e]
pop esp
xor ebp, 0x70
lodsb al, byte [esi]
outsd dx, dword [esi]
test al, 0xc3
test dword [ebp - 0x41], ebp
fadd qword [esi]
test al, 0xa8
xchg ecx, eax
test al, 0x91
shr byte [edi + 0x56], 1
add bh, byte [ebx - 0x57fa2219]
push esp
loop 0x9cfbfe
iretd

Function at 0xa23a08
Capabilities:
Encode data using base64

Disassembly:
jmp fcn.0063df68
inc cl
xor bl, cl
push 0xc6021abf
sub dword [esp + 4], 0x661e1f96
sbb edi, 2
mov word [edi], cx
call fcn.00640aa3
dec esp
lea eax, [0xff6267f5]
dec ebp
sub edi, eax
dec esp
lea eax, [ebx*4 - 0x585a08cb]
dec eax
lea ebx, [0xffc8282b]
adc edi, 2
not dword [esp + 3]
and ax, si
not ax
push 0x4a09dcac
call fcn.009dc98c
mov ebp, 0x5f59604c
or ch, byte [edx + 0x28]
call 0x7ffa9c14
xor al, 0x38
aaa
into
mov ecx, 0xf128cfc6
mov ecx, 0xceb073ad
dec esi
sbb bl, dl
add byte [ebp + esi*2 - 0x33f9b7a5], 0x24
scasd eax, dword es:[edi]
iretd
rol dword [esp + 4], 0xd
mov dword [esp], 0xc003a23f
mov si, word [edi + 2]
jnp 0x99f732
jns 0x9efa96
ror cl, 1
sub cl, 0xb8
jmp 0xa34f06
ror cl, 1
shr dword [esp + 4], 0x3e
push 0x6a8d8336
je 0x9d97e5
Function at 0x402a69
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x424010]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402afd
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402aba
cmp dword [ebp + 0x10], ebx
jne 0x402af1
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a69
test eax, eax
jne 0x402acc
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402aa1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
call fcn.004060b1
cmp eax, ebx
je 0x402b04
push ebx
push dword [0x424010]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402afd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x424010], ebx
jne 0x402afa
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402afa
jmp 0x402afd

Function at 0x402f4b
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x402f78
mov ecx, dword [0x423fb8]
push edi
add eax, ecx
push edi
push eax
mov dword [0x417104], eax
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00403076
cmp eax, edi
jl 0x40306f
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push eax
lea eax, [ebp + 8]
push esi
push eax
push dword [0x409018]
call ebx
test eax, eax
je 0x40306c
cmp dword [ebp - 4], esi
jne 0x40306c
push dword [ebp + 8]
add dword [0x417104], esi
call fcn.00403076
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x40306f
cmp dword [ebp + 0x10], edi
jne 0x40303b
cmp dword [ebp + 8], edi
jle 0x403067
mov esi, 0x413100
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x402feb
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push edi
push esi
push dword [0x409018]
call ebx
test eax, eax
je 0x40306c
cmp edi, dword [ebp - 4]
jne 0x40306c
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403037
cmp dword [ebp + 0x14], edi
jne 0x403037
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x417104], eax
cmp dword [ebp + 8], 0
jg 0x402fde
jmp 0x403067
push 0xfffffffffffffffe
jmp 0x40306e
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403046
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push edi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x409018]
call ebx
test eax, eax
je 0x40306c
mov eax, dword [ebp - 4]
add dword [0x417104], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x40306f
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x403076
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x417104]
sub esi, dword [0x40b070]
push edi
add esi, dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
add eax, 0x1f4
cmp esi, ebx
mov dword [0x423f6c], eax
jle 0x4031e0
push dword [0x41f114]
call fcn.00403224
push ebx
push ebx
push dword [0x40b070]
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x41f110], esi
mov dword [0x417100], ebx
mov ebp, 0x40b100
mov eax, dword [0x417108]
mov edi, 0x4000
sub eax, dword [0x41f114]
cmp eax, edi
jg 0x4030eb
mov edi, eax
mov esi, 0x413100
push edi
push esi
call fcn.004031f2
test eax, eax
je 0x4031d2
add dword [0x41f114], edi
mov dword [0x40b090], esi
mov dword [0x40b094], edi
cmp dword [0x423f70], ebx
je 0x403142
cmp dword [0x424000], ebx
jne 0x403142
mov eax, dword [0x41f110]
push ebx
sub eax, dword [0x417104]
sub eax, dword [esp + 0x1c]
add eax, dword [0x40b070]
mov dword [0x417100], eax
call fcn.00402c06
pop ecx
mov ecx, 0x40b078
mov dword [0x40b098], ebp
mov dword [0x40b09c], 0x8000
call fcn.004061ae
test eax, eax
jl 0x4031db
mov esi, dword [0x40b098]
sub esi, ebp
je 0x40319c
lea eax, [esp + 0x10]
push ebx
push eax
push esi
push ebp
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4031d7
cmp esi, dword [esp + 0x10]
jne 0x4031d7
add dword [0x40b070], esi
cmp dword [0x40b094], ebx
jne 0x403111
jmp 0x4031a8
cmp dword [0x40b094], ebx
jne 0x4031db
cmp edi, ebx
je 0x4031db
mov eax, dword [0x417104]
mov ecx, eax
sub ecx, dword [0x40b070]
add ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x4030d5
push ebx
push ebx
push eax
push dword [0x409018]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4031e0
or eax, 0xffffffff
jmp 0x4031ea
push 0xfffffffffffffffe
jmp 0x4031dd
push 0xfffffffffffffffd
pop eax
jmp 0x4031ea
push 1
call fcn.00402c06
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x40500d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00403b76
out 0x86, al
aam 0x40
lea eax, [ebp - 0x72c]
push eax
call fcn.00403b86
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00403b3b
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.00403b76
adc ebp, ebx
sub ah, al
lea eax, [ebp - 0x718]
push eax
push 0x40
push 5
push dword [ebp - 0x3a8]
call dword [ebp - 0x6e4]
push 5
lea eax, [ebp - 0x394]
push eax
push dword [ebp - 0x3a8]
call fcn.00403ae7
add esp, 0xc
lea eax, [ebp - 0x718]
push eax
push dword [ebp - 0x718]
push 5
push dword [ebp - 0x3a8]
call dword [ebp - 0x6e4]
call fcn.00403b76
invalid
invalid
invalid
Function at 0x405881
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
invalid
invalid
pop esp
clc

Function at 0x405d21
Capabilities:
Get common file path
Resolve function by parsing pe exports

Disassembly:
outsb dx, byte [esi]
xor byte [esi + 0x30a16474], 0
add byte [eax], al
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x405d3a
invalid
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]

Function at 0x405d37
Capabilities:
Get common file path

Disassembly:
outsb dx, byte [esi]
xor byte [esi + 0x30a16474], 0
add byte [eax], al
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x405d3a
invalid
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
Function at 0x401839
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
pushal
std
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
lea edi, [esi + ecx + 7]
push esi
push ecx
lea esi, [esi + ecx]
dec esi
rep movsb byte es:[edi], byte [esi]
pop ecx
pop esi
lea eax, [ecx + 8]
mov dword [ebp - 4], eax
mov edi, esi
xor eax, eax
test cl, 3
je 0x401865
inc eax
shr ecx, 2
add ecx, eax
shl ecx, 2
call fcn.0040194b
cld
stosd dword es:[edi], eax
mov edx, eax
lea eax, [ecx + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
stosd dword es:[edi], eax
shr ecx, 2
mov esi, edi
lodsd eax, dword [esi]
xor eax, edx
stosd dword es:[edi], eax
mov edx, eax
loop 0x401885
popal
mov eax, dword [ebp - 8]
leave
ret 8

Function at 0x402157
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
pushal
mov dword [ebp - 8], 0
cmp dword [ebp + 0x14], 1
jne 0x402172
mov dword [ebp + 0x14], 3
push 0
push pe_nt_image_headers32
push 2
push 0
push dword [ebp + 0x14]
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ebx, eax
inc eax
je 0x4021bb
lea eax, [ebp - 4]
push 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.kernel32.dll_WriteFile]
mov dword [ebp - 8], eax
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x4021bb
mov dword [ebp - 8], 0
popal
mov eax, dword [ebp - 8]
leave
ret 0x10
Function at 0x402225
Capabilities:
Get file attributes
Get file size
Read file on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0x64
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
push pe_nt_image_headers32
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ebx, eax
inc eax
je 0x4022e6
push 0
push ebx
call dword [sym.imp.kernel32.dll_GetFileSize]
mov ecx, dword [ebp + 0x14]
jecxz 0x402284
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
jecxz 0x40228b
mov eax, ecx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4022aa
cmp dword [ebp + 0x10], 0
je 0x40230a
push dword [ebp + 0x10]
push 0x40
call dword [sym.imp.kernel32.dll_LocalAlloc]
test eax, eax
je 0x40230a
mov esi, eax
mov edi, esi
lea eax, [ebp - 0xc]
push 0
push eax
push dword [ebp + 0x10]
push esi
push ebx
call dword [sym.imp.kernel32.dll_ReadFile]
mov eax, dword [ebp - 0xc]
sub dword [ebp + 0x10], eax
je 0x4022e1
test eax, eax
je 0x4022e1
add esi, eax
dec dword [ebp - 8]
jne 0x4022ae
cmp dword [ebp + 0xc], 0
je 0x40230a
push edi
call dword [sym.imp.kernel32.dll_LocalFree]
xor edi, edi
mov dword [ebp - 0x10], edi
jmp 0x40230a
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ebx, eax
inc eax
jne 0x402274
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
popal
mov eax, dword [ebp - 0x10]
leave
ret 0x10

Function at 0x4023dd
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
pushal
call 0x402416
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x40245b
push edi
imul ebp, dword [esi + 0x64], 0x5c73776f
inc ebx
jne 0x40247c
jb 0x402471
outsb dx, byte [esi]
je 0x402465
jb 0x402485
imul ebp, dword [edi + 0x6e], 0x85c75e00
invalid
mov dword [ebp - 4], 0x186a0
add dword [eax], eax
push 0
push 0
push 0
push 0
lea edx, [ebp - 4]
push edx
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push dword [ebp - 0x10c]
mov ch, 0xf8
invalid
call dword [sym.imp.advapi32.dll_RegEnumKeyExA]
cmp eax, 0x103
add byte [eax], al
je 0x4024ed
lea edx, [ebp - 0x104]
push edx
call fcn.00402372
cmp eax, 1
je 0x4024a2
inc dword [ebp - 0x108]
jmp 0x402456
cmp dword [ebp + 8], 0
je 0x4024e3
lea edx, [ebp - 0x104]
push edx
push esi
call fcn.004017d9
push dword [ebp + 8]
push eax
call fcn.004015e9
cmp dword [ebp + 0xc], 0
je 0x4024e3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 8
push 0
push 0
push dword [ebp - 0x10c]
call dword [sym.imp.advapi32.dll_RegGetValueA]
cmp eax, 0
jne 0x4024ed
mov dword [ebp - 0x110], 1
push dword [ebp - 0x10c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
popal
mov eax, dword [ebp - 0x110]
leave
ret 0xc