joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004ef0
Capabilities:
Enumerate files on windows
Get file attributes
Move file
Query or enumerate registry value

Disassembly:
sub esp, 0x55c
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100050b0
lea ecx, [esp + 0x14]
lea edx, [esp + 0x260]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.CommonFilesDir
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x10]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10004f75
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x55c
ret
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x260]
push str.systemmapi
push eax
lea ecx, [esp + 0x24]
push str._s_s.
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0x120]
lea eax, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x100050ae
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileA]
lea ecx, [esp + 0x14c]
lea edx, [esp + 0x260]
push ecx
push str.systemmapi
push edx
lea eax, [esp + 0x28]
push 0x1000dc9c
push eax
call esi
add esp, 0x14
lea ecx, [esp + 0x1c]
push ecx
call edi
test al, 0x10
je 0x1000506c
lea edx, [esp + 0x14c]
push 0x1000e078
push edx
call fcn.10006070
add esp, 8
test eax, eax
je 0x1000506c
lea eax, [esp + 0x14c]
push 0x1000e074
push eax
call fcn.10006070
add esp, 8
test eax, eax
je 0x1000506c
lea ecx, [esp + 0x1c]
push 0x1000e070
push ecx
lea edx, [esp + 0x470]
push 0x1000d914
push edx
call esi
add esp, 0x10
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x364]
push str.95old
push eax
push 0x1000d914
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0x364]
lea eax, [esp + 0x468]
push edx
push eax
call ebx
lea ecx, [esp + 0x120]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10004fc1
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edx, [esp + 0x10]
push edx
push str.SoftwareMicrosoftOffice9.0OutlookWin9xMig
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x100050ae
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x55c
ret
Function at 0x100050c0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
mov ecx, dword [esp + 0x110]
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows_Messaging_SubsystemProfiles
push ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x10005158
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x18]
mov eax, esi
push 0x104
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
inc esi
call edi
test eax, eax
jne 0x1000514c
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
push eax
call ebp
test eax, eax
jne 0x10005143
mov ecx, dword [esp + 0x14]
push ecx
call fcn.10005160
add esp, 4
mov edx, dword [esp + 0x14]
push edx
call ebx
jmp 0x10005108
mov eax, dword [esp + 0x10]
push eax
call ebx
pop ebx
pop ebp
xor eax, eax
pop edi
pop esi
add esp, 0x10c
ret
Function at 0x10005160
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x220
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], 0
xor ebx, ebx
mov esi, dword [esp + 0x234]
lea ecx, [esp + 0x12c]
mov eax, edi
push 0x104
push ecx
inc edi
push eax
push esi
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0x103
je 0x1000536f
test eax, eax
jne 0x10005176
lea edx, [esp + 0x10]
push edx
push 3
push eax
lea eax, [esp + 0x138]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10005176
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push edx
push eax
push 0
push str.001e6700
push ecx
mov dword [esp + 0x2c], 0x104
call esi
test eax, eax
jne 0x10005340
mov eax, dword [esp + 0x14]
cmp eax, 4
jb 0x10005340
lea edx, [esp + eax + 0x1f]
push 4
push edx
push str..pst
call fcn.10006430
add esp, 0xc
test eax, eax
jne 0x10005340
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push 0
push ecx
push 0
push str.01020fff
push edx
call esi
test eax, eax
jne 0x10005340
mov eax, dword [esp + 0x18]
inc eax
push eax
call fcn.10006360
add esp, 4
lea ecx, [esp + 0x18]
mov ebx, eax
mov eax, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push ebx
push edx
push 0
push str.01020fff
push eax
call esi
test eax, eax
jne 0x10005340
mov ecx, dword [esp + 0x18]
lea ebp, [ecx - 1]
mov edx, ebp
dec ebp
test edx, edx
je 0x10005340
lea eax, [ebp + ebx]
cmp byte [eax], 0
jne 0x10005294
mov dl, byte [eax - 1]
test dl, dl
je 0x100052a1
mov edx, ebp
dec ebp
dec eax
test edx, edx
jne 0x10005288
jmp 0x10005340
lea eax, [ebx + ecx - 5]
push 4
push eax
push str..pst
call fcn.10006430
add esp, 0xc
test eax, eax
jne 0x10005340
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x24]
dec ecx
lea eax, [ebp + ebx + 1]
push ecx
push edx
push eax
call fcn.10006430
add esp, 0xc
test eax, eax
je 0x10005340
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
lea ecx, [ebp + eax + 1]
cmp ecx, edx
jbe 0x100052f9
lea edx, [ebp + eax + 2]
push edx
push ebx
call fcn.100061b0
add esp, 8
mov ebx, eax
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + ebx + 1]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
lea edx, [ebp + ecx + 1]
push edx
push ebx
push 3
push 0
push str.01020fff
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [esp + 0x20]
test ebx, ebx
je 0x1000534f
push ebx
call fcn.10006140
add esp, 4
xor ebx, ebx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10005176
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], 0
jmp 0x10005176
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x220
ret
Function at 0x100055d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x100055f1
add esp, 0x208
ret
mov eax, dword [esp + 0x20c]
test eax, eax
mov eax, str.mapi32x.dll
jne 0x10005606
mov eax, str.mapi32.dll
push eax
lea ecx, [esp + 4]
push str.system
push ecx
lea edx, [esp + 0x110]
push 0x1000dc9c
push edx
call fcn.10005dd0
add esp, 0x14
lea eax, [esp + 0x104]
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x10005654
xor eax, eax
add esp, 0x208
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add esp, 0x208
ret

Function at 0x10005670
Capabilities:
Copy file

Disassembly:
sub esp, 0x30c
lea eax, [esp + 0x104]
push esi
push eax
call fcn.10003350
mov esi, eax
add esp, 4
test esi, esi
jne 0x100056ee
lea ecx, [esp + 0x108]
push str.outlook.exe
push ecx
lea edx, [esp + 0x214]
push str._s_s
push edx
call fcn.10005dd0
mov eax, dword [esp + 0x324]
add esp, 0x10
lea ecx, [esp + 4]
push str.outlook.exe
push eax
push 0x1000d914
push ecx
call fcn.10005dd0
add esp, 0x10
lea edx, [esp + 4]
lea eax, [esp + 0x20c]
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x100056ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
add esp, 0x30c
ret
Function at 0x100092e0
Capabilities:
Inspect section memory permissions

Disassembly:
mov esp, 0x8b10488b
add byte [ebx], bh
ret
Function at 0x100095f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.10008d1a
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10008ccf
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
test dword [ebx], ebx
cld
invalid
jmp dword [ebx - 0x3e37a3a]
invalid
inc dword [ecx - 0x3e27a3a]
invalid
dec dword [edx - 0x3e17a3a]
invalid
call [ebx - 0x3e07a3a]
invalid
inc dword [edx - 0x3df7a3a]
invalid
dec dword [ebx - 0x3de7a3a]
invalid
jmp dword [esi - 0x3dd7a3a]
invalid
dec dword [edi - 0x3dc7a3a]
invalid
inc dword [eax - 0x3db7a3a]
invalid
dec dword [edx - 0x3da7a3a]
invalid
inc dword [edx - 0x3d97a3a]
invalid
dec dword [ebx - 0x3d87a3a]
invalid
jmp [edi - 0x3d77a3a]
invalid
invalid
out dx, al
lea eax, [ebp - 0x3ec]
push eax
call fcn.10008d1a
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10008ccf
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.10008d0a
popal
mov dh, 0xaf
or al, 0x80
movsd dword es:[edi], dword [esi]
int3
Function at 0x1000b940
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [0x10011e18]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push edi
test eax, eax
jne 0x1000b988
push 0
push 0
push 1
push 0
call esi
test eax, eax
je 0x1000b968
mov eax, 2
jmp 0x1000b983
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1000ba68
mov eax, 1
mov dword [0x10011e18], eax
cmp eax, 2
jne 0x1000b9a8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 1
jne 0x1000ba7a
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x1000b9c3
mov ecx, dword [0x10011c48]
mov dword [esp + 0x24], ecx
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push 0
push 0
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, eax
test edi, edi
jne 0x1000b9e2
pop edi
pop esi
pop ebp
pop ebx
ret
lea edx, [edi + edi]
push edx
call fcn.10006360
mov esi, eax
add esp, 4
test esi, esi
jne 0x1000b9f9
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1000ba5f
mov eax, dword [esp + 0x20]
push 0
test eax, eax
push 0
jne 0x1000ba40
mov eax, dword [esp + 0x2c]
push 0
push 0
push 0xffffffffffffffff
push esi
push 0x220
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x1000ba5f
push esi
call fcn.10006140
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
push eax
push ecx
push 0xffffffffffffffff
push esi
push 0x220
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jne 0x1000ba6f
push esi
call fcn.10006140
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call fcn.10006140
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10004cd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x10004d02
lea esp, [esp]
test cl, 3
je 0x10004d02
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0xfeaa460]
add ecx, 1
sub esi, 1
jne 0x10004ce0
cmp esi, 0x20
push ebx
push edi
jb 0x10004eec
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0xfeaa860]
xor edx, dword [ebx*4 + 0xfeaac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0xfeaa460]
add ecx, 4
xor edx, dword [eax*4 + 0xfeab060]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0xfeaa860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0xfeaac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0xfeaa460]
add ecx, 4
xor eax, dword [edx*4 + 0xfeab060]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0xfeaa860]
xor edx, dword [ebx*4 + 0xfeaac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0xfeaa460]
xor edx, dword [eax*4 + 0xfeab060]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0xfeaa860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0xfeaac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0xfeaa460]
xor eax, dword [edx*4 + 0xfeab060]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0xfeaa860]
xor edx, dword [ebx*4 + 0xfeaac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0xfeaa460]
xor edx, dword [eax*4 + 0xfeab060]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0xfeaa860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0xfeaac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0xfeaa460]
and edx, 0xff
xor eax, dword [edx*4 + 0xfeab060]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0xfeaa860]
xor edx, dword [ebx*4 + 0xfeaac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0xfeaa460]
add ecx, 4
xor edx, dword [eax*4 + 0xfeab060]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0xfeaa860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0xfeaac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0xfeaa460]
and edx, 0xff
xor eax, dword [edx*4 + 0xfeab060]
sub edi, 1
jne 0x10004d12
cmp esi, 4
jb 0x10004f39
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0xfeaa860]
movzx ebx, ah
xor edi, dword [ebx*4 + 0xfeaac60]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0xfeaa460]
and eax, 0xff
xor edi, dword [eax*4 + 0xfeab060]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x10004ef6
test esi, esi
pop edi
pop ebx
je 0x10004f5d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0xfeaa460]
add ecx, 1
sub esi, 1
jne 0x10004f40
not eax
pop esi
ret
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x778b3235
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x15ea3d74
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x42c231
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x90
push ebx
push ebp
mov ebp, dword [esp + 0x9c]
lea eax, [esp + 8]
push esi
push edi
push 0x90
xor ebx, ebx
push ebx
push eax
call fcn.0042d670
mov edx, dword [esp + 0xb4]
add esp, 0xc
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 5]
mov dword [esp + 0x10], ecx
movzx ecx, byte [edx + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
mov dword [esp + 0x14], ecx
movzx ecx, byte [edx + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
mov dword [esp + 0x18], ecx
movzx ecx, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xf]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + ebx*4 + 0x1c]
xor ecx, dword [esp + ebx*4 + 0x18]
xor ecx, dword [esp + ebx*4 + 0x14]
xor ecx, dword [ebp + ebx*4]
mov eax, ecx
shr eax, 0x18
movzx edi, byte [eax + 0x472048]
mov eax, ecx
shr eax, 0x10
movzx eax, al
shl edi, 8
movzx eax, byte [eax + 0x472048]
or edi, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl edi, 8
movzx eax, byte [eax + 0x472048]
or edi, eax
movzx eax, cl
mov esi, edi
shl esi, 8
movzx edx, byte [eax + 0x472048]
or esi, edx
mov ecx, esi
mov eax, esi
ror ecx, 0x1e
ror eax, 0x16
xor ecx, eax
mov eax, esi
ror eax, 0xe
xor ecx, eax
bswap edx
or edx, edi
xor ecx, edx
xor ecx, dword [esp + ebx*4 + 0x10]
xor ecx, esi
mov dword [esp + ebx*4 + 0x20], ecx
inc ebx
cmp ebx, 0x20
jb 0x42c2e9
mov edx, dword [esp + 0xac]
mov ecx, dword [esp + 0x9c]
mov eax, ecx
shr eax, 0x18
pop edi
mov byte [edx], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 1], al
mov eax, ecx
shr eax, 8
mov byte [edx + 2], al
mov byte [edx + 3], cl
mov ecx, dword [esp + 0x94]
mov eax, ecx
shr eax, 0x18
mov byte [edx + 4], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 5], al
mov eax, ecx
shr eax, 8
mov byte [edx + 6], al
mov byte [edx + 7], cl
mov ecx, dword [esp + 0x90]
mov eax, ecx
shr eax, 0x18
mov byte [edx + 8], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 9], al
mov eax, ecx
shr eax, 8
mov byte [edx + 0xa], al
mov byte [edx + 0xb], cl
mov ecx, dword [esp + 0x8c]
mov eax, ecx
shr eax, 0x18
mov byte [edx + 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 0xd], al
mov eax, ecx
pop esi
pop ebp
shr eax, 8
pop ebx
mov byte [edx + 0xe], al
mov byte [edx + 0xf], cl
add esp, 0x90
ret
Function at 0x42c400
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x90
mov edx, dword [ebp + 0x7c]
push esi
push edi
mov edi, dword [ebp + 0x78]
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 5]
xor ecx, 0xa3b1bac6
mov dword [ebp - 0x20], ecx
movzx ecx, byte [edx + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
xor ecx, 0x56aa3350
mov dword [ebp - 0x1c], ecx
movzx ecx, byte [edx + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
xor ecx, 0x677d9197
mov dword [ebp - 0x18], ecx
movzx ecx, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xf]
shl ecx, 8
or ecx, eax
xor ecx, 0xb27022dc
xor esi, esi
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + esi - 0x14]
xor ecx, dword [esi + 0x472158]
xor ecx, dword [ebp + esi - 0x18]
xor ecx, dword [ebp + esi - 0x1c]
mov eax, ecx
shr eax, 0x18
movzx edx, byte [eax + 0x472048]
mov eax, ecx
shr eax, 0x10
movzx eax, al
shl edx, 8
movzx eax, byte [eax + 0x472048]
or edx, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + 0x472048]
or edx, eax
movzx eax, cl
shl edx, 8
movzx eax, byte [eax + 0x472048]
or edx, eax
mov ecx, edx
mov eax, edx
ror ecx, 0x13
ror eax, 9
xor ecx, eax
xor ecx, dword [ebp + esi - 0x20]
xor ecx, edx
mov dword [ebp + esi - 0x10], ecx
mov dword [esi + edi], ecx
add esi, 4
cmp esi, 0x80
jb 0x42c4b4
pop edi
pop esi
add ebp, 0x70
leave
ret

Function at 0x42cc83
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42ccc2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42ccc2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42ccc2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42ccc2
cmp dword [ecx + 0x74], 0xe
jbe 0x42ccc2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x432c7e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x432d1b
push ebx
push esi
call fcn.00432c47
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00432bdb
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x432cc8
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x432d1a
push edi
push eax
call fcn.00433511
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x432ce8
call fcn.004317a5
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x432d19
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00432bdb
add esp, 0x20
test eax, eax
jne 0x432d07
push edi
call fcn.004317a5
jmp 0x432d0f
push ebx
call fcn.004317a5
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x433bf7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x474068
push 0x474060
push str.FlsAlloc
push 0x1f
call fcn.00433b13
mov esi, eax
add esp, 0x10
test esi, esi
je 0x433c2b
push dword [ebp + 8]
mov ecx, esi
call dword [0x44910c]
call esi
jmp 0x433c31
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x433c75
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x474078
push 0x474070
push str.FlsGetValue
push 0x21
call fcn.00433b13
mov esi, eax
add esp, 0x10
test esi, esi
je 0x433cac
push dword [ebp + 8]
mov ecx, esi
call dword [0x44910c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x433cb4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x474080
push 0x474078
push str.FlsSetValue
push 0x22
call fcn.00433b13
mov esi, eax
add esp, 0x10
test esi, esi
je 0x433cee
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x44910c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4388b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4388dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4388dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219