joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40aa38
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40aad5
push ebx
push esi
call fcn.0040aa01
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040a995
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40aa82
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40aad4
push edi
push eax
call fcn.00407955
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40aaa2
call fcn.0040791b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40aad3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040a995
add esp, 0x20
test eax, eax
jne 0x40aac1
push edi
call fcn.0040791b
jmp 0x40aac9
push ebx
call fcn.0040791b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40b791
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4152a8
push 0x4152a0
push str.FlsAlloc
push 0x1f
call fcn.0040b6ad
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b7c5
push dword [ebp + 8]
mov ecx, esi
call dword [0x413168]
call esi
jmp 0x40b7cb
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40b80f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4152b8
push 0x4152b0
push str.FlsGetValue
push 0x21
call fcn.0040b6ad
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b846
push dword [ebp + 8]
mov ecx, esi
call dword [0x413168]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40b84e
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4152c0
push 0x4152b8
push str.FlsSetValue
push 0x22
call fcn.0040b6ad
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b888
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x413168]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x412600
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41262d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41262d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4028a6
Capabilities:
Decrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ebx
mov ebx, dword [eax + 8]
push esi
mov dword [ebp - 0x18], ecx
mov ecx, dword [eax + 4]
mov eax, dword [eax + 0xc]
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi]
mov edx, dword [edi + 4]
mov dword [ebp - 4], 0xc6ef3720
mov dword [ebp - 0x1c], 0x9e3779b9
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x20
mov eax, esi
shl eax, 4
add eax, ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
lea ecx, [eax + esi]
mov eax, esi
shr eax, 5
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x10]
add dword [ebp + 8], eax
push ecx
lea eax, [ebp - 8]
push eax
call fcn.00402896
mov eax, dword [ebp + 8]
xor eax, dword [ebp - 8]
and dword [0x440f74], 0
or dword [0x440f7c], 0xffffffff
sub edx, eax
mov eax, dword [ebp - 4]
lea ecx, [eax + edx]
mov eax, edx
shr eax, 5
mov dword [0x440f78], 0xff6b3619
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x14]
add dword [ebp + 8], eax
and dword [ebp + 0xc], 0
mov eax, edx
shl eax, 4
add eax, dword [ebp - 0x18]
xor eax, dword [ebp + 8]
xor eax, ecx
sub esi, eax
mov eax, dword [ebp - 0x1c]
add dword [ebp + 0xc], eax
sub dword [ebp - 4], eax
dec dword [ebp - 0xc]
jne 0x4028e3
mov dword [edi], esi
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40717c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420388]
jne 0x407186
repz ret
jmp fcn.0040980e

Function at 0x40881e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004068a4
and dword [ebp - 4], 0
cmp dword [0x441ef4], 0
mov ebx, eax
jne 0x4088cf
push 0x401ca8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408980
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401c9c
push edi
call esi
test eax, eax
je 0x408980
push eax
call fcn.00406832
mov dword [esp], 0x401c8c
push edi
mov dword [0x441ef4], eax
call esi
push eax
call fcn.00406832
mov dword [esp], 0x401c78
push edi
mov dword [0x441ef8], eax
call esi
push eax
call fcn.00406832
mov dword [esp], 0x401c5c
push edi
mov dword [0x441efc], eax
call esi
push eax
call fcn.00406832
pop ecx
mov dword [0x441f04], eax
test eax, eax
je 0x4088cf
push 0x401c44
push edi
call esi
push eax
call fcn.00406832
pop ecx
mov dword [0x441f00], eax
mov eax, dword [0x441f00]
cmp eax, ebx
je 0x408927
cmp dword [0x441f04], ebx
je 0x408927
push eax
call fcn.004068ad
push dword [0x441f04]
mov esi, eax
call fcn.004068ad
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408927
test edi, edi
je 0x408927
call esi
test eax, eax
je 0x40891e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40891e
test byte [ebp - 0xc], 1
jne 0x408927
or dword [ebp + 0x10], 0x200000
jmp 0x408960
mov eax, dword [0x441ef8]
cmp eax, ebx
je 0x408960
push eax
call fcn.004068ad
pop ecx
test eax, eax
je 0x408960
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408960
mov eax, dword [0x441efc]
cmp eax, ebx
je 0x408960
push eax
call fcn.004068ad
pop ecx
test eax, eax
je 0x408960
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x441ef4]
call fcn.004068ad
pop ecx
test eax, eax
je 0x408980
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408982
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401340
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5f7100]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x20], ecx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0x14]
jae 0x401378
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
jmp 0x40137e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jbe 0x4013c6
mov edx, dword [ebp - 0x20]
add edx, 8
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4013c6
mov edx, dword [ebp - 0x20]
add edx, 8
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.00401450
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0055c88f
mov esp, ebp
pop ebp
ret 8

Function at 0x4013e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
add eax, 0x1c
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40142f
mov eax, dword [ebp - 0xc]
add eax, 0x1c
push eax
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.00401450
cmp eax, 0xffffffff
jne 0x40142f
or eax, 0xffffffff
jmp 0x401440
cmp dword [ebp + 0x10], 0
je 0x40143d
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402100
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x5f7100]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
cmp dword [eax + 4], 0
jne 0x402123
xor eax, eax
jmp 0x40220b
mov dword [ebp - 0x38], 0
jmp 0x402135
mov ecx, dword [ebp - 0x38]
add ecx, 1
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp + 0xc]
jge 0x40213f
jmp 0x40212c
mov ecx, dword [ebp - 0x3c]
add ecx, 0x5c
push ecx
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x4021f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x4021da
push 1
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0x3c]
add edx, 0x5c
push edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x4021d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x3e4
je 0x4021d6
mov edx, dword [ebp - 0x28]
push edx
push str._CE__u_
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
jmp 0x4021d8
jmp 0x402179
jmp 0x4021f4
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
or eax, 0xffffffff
jmp 0x40220b
jmp 0x4021fb
or eax, 0xffffffff
jmp 0x40220b
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0055c88f
mov esp, ebp
pop ebp
ret 8

Function at 0x402220
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 1
jne 0x40223a
mov ecx, dword [ebp - 0x10]
call fcn.004022c0
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x14], 0
je 0x4022ad
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x10], 0
push 0x7d0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x14]
mov edx, dword [ecx + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40227d
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x14]
mov edx, dword [ecx + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x4022a6
push 1
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x14], eax
jmp 0x4022ad
mov dword [ebp - 0x14], 0
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4065a0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58f93b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5f7100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.00406210
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax], vtable.CryptoPP::BaseN_Decoder.0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 4], vtable.CryptoPP::BaseN_Decoder.1.0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x18], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x1c], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x20], 0
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x24], 0
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x2c], 0
push 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0x30
call fcn.0040b460
mov byte [ebp - 4], 1
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0x1c]
call fcn.0044ecc0
push 1
lea eax, [ebp + 8]
push eax
call fcn.004064d0
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.00414d30
add esp, 0x10
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
mov byte [ebp - 4], 2
lea eax, [ebp + 0xc]
push eax
call fcn.004064c0
push eax
mov ecx, dword [ebp - 0x24]
call fcn.00414d00
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00451520
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004060e0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x410190
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58dff8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x5f7100]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
cmp dword [eax + 0x44], 0
je 0x4101d0
mov ecx, dword [ebp - 0x58]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x4101dc
mov al, 1
jmp 0x41037f
mov dword [ebp - 0x10], 8
call fcn.00403570
push eax
mov eax, dword [ebp - 0x58]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x58]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.00403570
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.00403520
add esp, 8
movzx eax, al
test eax, eax
je 0x41021f
xor al, al
jmp 0x41037f
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.0040eb60
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x44]
push edx
lea ecx, [ebp - 0x34]
call fcn.0040eea0
mov ecx, eax
call fcn.004246a0
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.00409ee0
add esi, eax
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040eea0
mov ecx, eax
call fcn.004246a0
push eax
mov ecx, dword [ebp - 0x58]
add ecx, 0x4c
push ecx
mov edx, dword [ebp - 0x58]
mov ecx, dword [edx + 0x44]
call fcn.00413360
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x41029a
cmp dword [ebp - 0x5c], 1
je 0x4102a1
cmp dword [ebp - 0x5c], 3
je 0x41033b
jmp 0x410353
mov eax, dword [ebp - 0x58]
mov byte [eax + 0x49], 0
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x34]
call fcn.0040eea0
mov ecx, eax
call fcn.004246a0
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x410304
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.0040eea0
mov ecx, eax
call fcn.004246a0
push eax
call fcn.0055d715
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x410304
mov byte [ebp - 0x51], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00409d40
mov al, byte [ebp - 0x51]
jmp 0x41037f
mov ecx, dword [ebp - 0x58]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x410327
mov byte [ebp - 0x52], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00409d40
mov al, byte [ebp - 0x52]
jmp 0x41037f
cmp dword [ebp - 0x38], 0
jne 0x410339
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.0040ecb0
jmp 0x41036b
mov byte [ebp - 0x53], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00409d40
mov al, byte [ebp - 0x53]
jmp 0x41037f
mov byte [ebp - 0x54], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00409d40
mov al, byte [ebp - 0x54]
jmp 0x41037f
jmp 0x410232
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0055c88f
mov esp, ebp
pop ebp
ret
Function at 0x417520
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
mov esp, ebp
pop ebp
ret 4

Function at 0x41b8b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jae 0x41b8fe
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x41b8fc
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x41b8d0
jmp 0x41b8c2
mov esp, ebp
pop ebp
ret 4
Function at 0x423700
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
mov eax, dword [0x5f7100]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xe4], ecx
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.HARDWAREDEVICEMAPSERIALCOMM
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4238b4
mov dword [ebp - 0x9c], 0x20
mov dword [ebp - 0x98], 0x80
mov dword [ebp - 0x94], 0
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0xe8], ecx
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x9c]
push edx
lea eax, [ebp - 0xe0]
push eax
mov ecx, dword [ebp - 0xe8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ecx, dword [ebp - 0x94]
add ecx, 1
mov dword [ebp - 0x94], ecx
test eax, eax
jne 0x4238aa
mov dword [ebp - 0x9c], 0x20
push 0x5c5078
lea edx, [ebp - 0xe0]
push edx
call fcn.004300f0
add esp, 8
test eax, eax
je 0x4238a5
mov dword [ebp - 0x98], 0x80
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x90]
push ecx
push 0
push 0
lea edx, [ebp - 0xe0]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x90]
mov dword [ebp - 0xec], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0xf0], edx
mov eax, dword [ebp - 0xf0]
mov cx, word [eax]
mov word [ebp - 0xf2], cx
mov edx, dword [ebp - 0xec]
cmp cx, word [edx]
jne 0x423874
cmp word [ebp - 0xf2], 0
je 0x423868
mov eax, dword [ebp - 0xf0]
mov cx, word [eax + 2]
mov word [ebp - 0xf4], cx
mov edx, dword [ebp - 0xec]
cmp cx, word [edx + 2]
jne 0x423874
add dword [ebp - 0xf0], 4
add dword [ebp - 0xec], 4
cmp word [ebp - 0xf4], 0
jne 0x42380e
mov dword [ebp - 0xf8], 0
jmp 0x42387f
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0xf8], eax
mov ecx, dword [ebp - 0xf8]
mov dword [ebp - 0xfc], ecx
cmp dword [ebp - 0xfc], 0
jne 0x4238a5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x4238b6
jmp 0x42375c
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0055c88f
mov esp, ebp
pop ebp
ret 4

Function at 0x427300
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret
Function at 0x4309b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5f7100]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0xc], 0x3a
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 0xa], 0x31
mov byte [ebp - 9], 0x52
mov byte [ebp - 8], 0x31
mov byte [ebp - 7], 0x4f
mov byte [ebp - 6], 0x4e
mov byte [ebp - 5], 0xde
push 0
push 8
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x44
call fcn.004013e0
push 0xf
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 0x14], 0x3a
mov byte [ebp - 0x13], 0x53
mov byte [ebp - 0x12], 0x31
mov byte [ebp - 0x11], 0x52
mov byte [ebp - 0x10], 0x37
mov byte [ebp - 0xf], 0x4f
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0xd], 0xdc
push 0
push 8
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x20]
add ecx, 0x44
call fcn.004013e0
push 0xf
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 0x1c], 0x3a
mov byte [ebp - 0x1b], 0x53
mov byte [ebp - 0x1a], 0x31
mov byte [ebp - 0x19], 0x52
mov byte [ebp - 0x18], 0x38
mov byte [ebp - 0x17], 0x4f
mov byte [ebp - 0x16], 0x46
mov byte [ebp - 0x15], 0xdd
push 0
push 8
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x20]
add ecx, 0x44
call fcn.004013e0
push 0xf
call dword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, byte [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.00430910
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055c88f
mov esp, ebp
pop ebp
ret 4

Function at 0x430dd0
Capabilities:
Reference absolute stream path on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x5f7100]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x30], ecx
push 0x1000
push 0x1000
push 0
mov ecx, dword [ebp - 0x30]
call fcn.00431100
test eax, eax
jne 0x430dff
xor al, al
jmp 0x430e6b
mov dword [ebp - 4], 0x46
mov eax, dword [ebp + 8]
push eax
push str..COM_d:115200_N_8_0
lea ecx, [ebp - 0x28]
push ecx
call fcn.00431030
add esp, 0xc
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
lea edx, [ebp - 0x28]
push edx
call fcn.00430110
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x30]
call fcn.00431240
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x430e4e
mov ecx, dword [ebp - 0x30]
call fcn.00431620
test eax, eax
je 0x430e4e
mov al, 1
jmp 0x430e6b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
test eax, eax
jne 0x430e06
xor al, al
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0055c88f
mov esp, ebp
pop ebp
ret 4
Function at 0x431640
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5f7100]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
add eax, 0x2c
push eax
lea ecx, [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x431719
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x3e5
jne 0x4316f4
push 1
lea eax, [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x2c
push ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x4316f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x3e4
je 0x4316f0
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
xor eax, eax
jmp 0x43171e
jmp 0x4316a7
jmp 0x431719
cmp dword [ebp - 0x20], 5
jne 0x431700
xor eax, eax
jmp 0x43171e
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
xor eax, eax
jmp 0x43171e
mov eax, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055c88f
mov esp, ebp
pop ebp
ret 8