joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499ee4
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49a07e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x49a094
lea edx, [ebp - 0xc]
movzx eax, si
call fcn.00408c44
push dword [ebp - 0xc]
push 0x49a0a4
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404898
mov ecx, dword [ebp - 8]
mov dl, 8
mov eax, ebx
call fcn.0049b210
test si, si
jne 0x499f85
push 2
push 0x10000
lea eax, [ebx + 0x30]
push eax
movzx eax, word [ebx + 0x10290]
push eax
call sub.wsock32.dll_recv
cmp eax, 0xffffffff
jne 0x499f74
lea ecx, [ebp - 0x10]
mov dx, 0x2733
mov eax, ebx
call fcn.0049b144
mov eax, dword [ebp - 4]
call fcn.00404520
jmp 0x499fdb
mov esi, eax
cmp esi, 0xffff
jbe 0x499fdb
call fcn.0040362c
jmp 0x499fdb
push 2
push 0x10000
lea eax, [ebx + 0x30]
push eax
movzx eax, word [ebx + 0x10290]
push eax
call sub.wsock32.dll_recv
movzx edx, si
cmp eax, edx
jge 0x499fdb
test eax, eax
jne 0x499fb5
mov eax, dword [ebp - 4]
call fcn.00404520
jmp 0x49a063
inc eax
jne 0x499fc6
lea ecx, [ebp - 0x14]
mov dx, 0x2733
mov eax, ebx
call fcn.0049b144
mov eax, dword [0x4a3040]
mov eax, dword [eax]
call fcn.004507c8
cmp byte [ebx + 0x10090], 0
je 0x499f85
cmp byte [ebx + 0x10090], 0
jne 0x49a02e
movzx edi, si
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00404b5c
push 0
push edi
mov eax, dword [ebp - 4]
call fcn.00404a28
mov edx, 1
dec edx
test eax, eax
je 0x49a00b
cmp edx, dword [eax - 4]
jb 0x49a010
call fcn.0040362c
inc edx
lea eax, [eax + edx - 1]
push eax
movzx eax, word [ebx + 0x10290]
push eax
call sub.wsock32.dll_recv
mov edx, dword [ebp - 4]
xchg edx, eax
call fcn.00404b5c
jmp 0x49a063
mov byte [ebx + 0x10090], 0
mov ecx, 0x49a0b0
mov dl, 1
mov eax, dword [0x499184]
call fcn.0040c634
call fcn.00403f64
cmp word [ebx + 0x1028a], 0
je 0x49a063
mov edx, ebx
mov eax, dword [ebx + 0x1028c]
call dword [ebx + 0x10288]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a085
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404544
ret
Function at 0x49a4b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004049c0
xor eax, eax
push ebp
push 0x49a686
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x49a69c
mov dl, 8
mov eax, dword [ebp - 4]
call fcn.0049b210
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x100bc], edx
mov eax, dword [ebp - 4]
call fcn.0049aaa0
xor eax, eax
push ebp
push 0x49a661
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x416278]
call fcn.0041acf8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x49a5f9
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x49a5d3
push 0
push 0x10000
mov eax, dword [ebp - 4]
add eax, 0x30
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10290]
push eax
call sub.wsock32.dll_recv
mov ebx, eax
test ebx, ebx
jle 0x49a597
mov eax, dword [ebp - 4]
lea edx, [eax + 0x30]
mov ecx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0041aa4c
mov eax, dword [ebp - 4]
add dword [eax + 0x100bc], ebx
mov eax, dword [ebp - 4]
cmp word [eax + 0x100c2], 0
je 0x49a58f
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x100c4]
call dword [esi + 0x100c0]
mov eax, dword [ebp - 4]
call fcn.0049aaa0
cmp ebx, 0xffffffff
jne 0x49a5c3
call sub.wsock32.dll_WSAGetLastError
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10094], esi
cmp esi, 0x2749
je 0x49a5e3
lea ecx, [ebp - 0x10]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.0049b144
test ebx, ebx
je 0x49a5e3
mov eax, dword [0x4a3040]
mov eax, dword [eax]
call fcn.004507c8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10090], 0
je 0x49a533
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a600
mov eax, dword [ebp - 0xc]
call fcn.004036ec
ret
Function at 0x49b04c
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x49b118
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x49b12c
mov dl, 4
mov eax, ebx
call fcn.0049b210
mov byte [ebx + 0x10298], 0
mov si, word [ebx + 0x10290]
cmp si, 0xffff
je 0x49b102
movzx eax, si
push eax
call sub.wsock32.dll_closesocket
test eax, eax
jne 0x49b0f4
test byte [ebx + 0x1c], 8
jne 0x49b0b1
cmp word [ebx + 0x10052], 0
je 0x49b0b1
mov edx, ebx
mov eax, dword [ebx + 0x10054]
call dword [ebx + 0x10050]
cmp byte [ebx + 0x10091], 0
jne 0x49b102
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x49b0d4
call fcn.0040362c
mov word [ebx + 0x10290], si
push 0x3d
push 0x465
mov eax, dword [ebx + 0x10294]
push eax
movzx eax, si
push eax
call sub.wsock32.dll_WSAAsyncSelect
jmp 0x49b102
lea ecx, [ebp - 4]
mov dx, 0x2733
mov eax, ebx
call fcn.0049b144
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b11f
lea eax, [ebp - 4]
call fcn.00404520
ret

Function at 0x49b2b8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x49b2f4
mov dl, 8
mov eax, ebx
call fcn.0049b210
push 2
push 1
lea eax, [ebx + 0x30]
push eax
movzx eax, word [ebx + 0x10290]
push eax
call sub.wsock32.dll_recv
test eax, eax
jle 0x49b2e6
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x49b304
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x49b30b
mov eax, dword [esp + 0x10000]
mov ebx, eax
mov ecx, 0x49b358
mov dl, 8
mov eax, ebx
call fcn.0049b210
push 0
push 0x10000
lea eax, [esp + 8]
push eax
movzx eax, word [ebx + 0x10290]
push eax
call sub.wsock32.dll_recv
add esp, 0x10004
pop ebx
ret

Function at 0x49b590
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
mov edi, esp
mov dword [edi], 0x10
push edi
lea edx, [esp + 8]
push edx
movzx eax, word [eax + 0x10290]
push eax
call sub.wsock32.dll_getsockname
push dword [esp + 8]
call sub.wsock32.dll_inet_ntoa
mov ebx, eax
xor eax, eax
mov dword [edi], eax
xor eax, eax
mov edx, dword [edi]
cmp byte [ebx + edx], 0x2e
jne 0x49b5d3
mov edx, dword [edi]
mov byte [ebx + edx], 0x2c
inc eax
inc dword [edi]
cmp eax, 3
jl 0x49b5c4
mov edx, esi
mov eax, ebx
call fcn.004091f4
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x49b5ec
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
mov esi, edx
mov dword [esp], 0x10
push esp
lea edx, [esp + 8]
push edx
movzx eax, word [eax + 0x10290]
push eax
call sub.wsock32.dll_getsockname
push esi
mov bx, word [esp + 0xa]
mov eax, ebx
and ax, 0xff
movzx eax, ax
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], 0
shr bx, 8
movzx eax, bx
mov dword [esp + 0x20], eax
mov byte [esp + 0x24], 0
lea edx, [esp + 0x18]
mov ecx, 1
mov eax, 0x49b658
call fcn.00409770
add esp, 0x24
pop esi
pop ebx
ret
Function at 0x49d954
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
mov eax, dword [ebp - 4]
add eax, 0x14
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], ebx
test ebx, ebx
jbe 0x49d9e8
xor eax, eax
push ebp
push 0x49d9d2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0049d8b8
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], esi
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.version.dll_GetFileVersionInfoA
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 8], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49d9e8
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x404ac4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
xor ebx, ebx
inc ebx
cmp dword [esi + 0x24f0], 0
je 0x404b0c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x24f4]
cmp eax, 0x61a8
jbe 0x404afb
push 0x94
mov ecx, esi
call fcn.00404b50
jmp 0x404b46
cmp dword [esi + 0x24f0], 0
je 0x404b0c
mov byte [esi + 0x2511], bl
jmp 0x404b46
push dword [ebp + 8]
mov ecx, esi
mov byte [esi + 0x2511], 0
call fcn.00405251
push 0
push 0x7d0
push 0x94
push dword [esi + 0xc]
mov bl, al
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 0x24f0], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x24f4], eax
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x407449
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push 0
lea eax, [ebp - 8]
push eax
push 4
call dword [sym.imp.KERNEL32.dll_GetUserPreferredUILanguages]
test eax, eax
je 0x4074d0
mov eax, dword [ebp - 4]
test eax, eax
je 0x4074d0
push 2
xor ecx, ecx
pop edx
mul edx
push 4
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_951]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4074d0
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 4
call dword [sym.imp.KERNEL32.dll_GetUserPreferredUILanguages]
test eax, eax
je 0x4074c8
cmp dword [ebp - 4], 0
jbe 0x4074c8
push 0x10
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
add esp, 0xc
test eax, eax
je 0x4074d0
cmp eax, 0xffff
ja 0x4074d0
jmp 0x4074d6
push esi
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_456]
pop ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
pop esi
test ax, ax
je 0x4074f6
xor edx, edx
cmp dx, cx
je 0x4074f6
push 0x7f
pop edx
cmp dx, cx
jne 0x4074fb
mov eax, 0x409
movzx eax, ax
mov esp, ebp
pop ebp
ret
Function at 0x4078d2
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x4101e0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, edx
push edi
test esi, esi
je 0x4079d4
test ecx, ecx
js 0x4079d4
push 0xa
push ecx
push 0x14
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_382]
xor eax, eax
lea edi, [ebp - 0xd8]
stosd dword es:[edi], eax
mov ebx, 0x400
push 0x32
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xc4]
and dword [ebp - 0xdc], 0
and dword [ebp - 0xd8], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push eax
push 0x10
push ebx
call edi
lea eax, [ebp - 0xc4]
mov edx, eax
movzx ecx, word [eax]
test cx, cx
je 0x407962
cmp ecx, 0x3b
je 0x407958
mov word [edx], cx
add edx, 2
add eax, 2
lea ecx, [ebp - 0x60]
cmp eax, ecx
jb 0x407945
xor eax, eax
mov word [edx], ax
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xc4]
push eax
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_710]
test eax, eax
jne 0x407986
push 0x396d7462
jmp 0x4079d9
push 0xa
lea eax, [ebp - 0x1c]
push eax
push 0xe
push ebx
call edi
lea eax, [ebp - 0x1c]
push 0xa
mov dword [ebp - 0xd0], eax
lea eax, [ebp - 0x30]
push eax
push 0xf
push ebx
call edi
push 0x14
lea eax, [ebp - 0x30]
push esi
mov dword [ebp - 0xcc], eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
test eax, eax
jne 0x4079d0
push 0x396d7463
jmp 0x4079d9
mov al, 1
jmp 0x4079e1
push 0x396d7461
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_1360]
xor al, al
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409d37
mov esp, ebp
pop ebp
ret 4
Function at 0x4087dd
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d8
mov eax, dword [0x4101e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x4d4], eax
cmp dword [esi + 0x15f0], 1
je 0x408816
cmp dword [esi + 0x15f4], 1
jne 0x40891f
cmp byte [esi + 0x1b10], 0
jne 0x408836
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x40891f
mov byte [esi + 0x1b10], 1
cmp dword [esi + 0x15f0], 1
jne 0x4088a9
push ebx
lea ecx, [ebp - 0x218]
call fcn.00408774
mov ebx, 0x2b4
lea eax, [ebp - 0x4d0]
push ebx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x4d0]
push 0x311
push ebx
push eax
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x4d0]
test eax, eax
je 0x408891
mov dword [esi + 0x1a84], eax
push 0x104
lea edx, [esi + 0x15fa]
lea ecx, [ebp - 0x4c4]
call fcn.004010e6
jmp 0x4088ae
mov ebx, 0x2b4
cmp dword [esi + 0x15f4], 1
jne 0x40891f
push dword [ebp - 0x4d4]
lea ecx, [ebp - 0x218]
call fcn.00408774
push ebx
lea eax, [ebp - 0x4d0]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x4d0]
push 0x311
push ebx
push eax
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x4d0]
test eax, eax
je 0x408909
mov dword [esi + 0x1a88], eax
push 0x104
lea edx, [esi + 0x183e]
lea ecx, [ebp - 0x4c4]
call fcn.004010e6
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00409d37
mov esp, ebp
pop ebp
ret 8

Function at 0x4090f5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4101e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea eax, [ebp - 0x20c]
push edi
push 0xffffffffffffffff
push ecx
push 0x104
push eax
mov edi, edx
call esi
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add eax, 2
lea ecx, [ebp - 4]
push 0xffffffffffffffff
sub ecx, eax
push edi
sar ecx, 1
push ecx
push eax
call esi
add esp, 0x28
lea ecx, [ebp - 0x20c]
xor ebx, ebx
push ebx
call fcn.0040197a
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x409169
mov dword [0x413468], ebx
jmp 0x409170
call edi
mov dword [0x413468], eax
test esi, esi
je 0x40917c
mov dword [0x413464], ebx
jmp 0x409193
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [0x413464], eax
cmp eax, 0xffffffff
je 0x40919b
mov dword [0x413460], ebx
jmp 0x4091a2
call edi
mov dword [0x413460], eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409d37
mov esp, ebp
pop ebp
ret
Function at 0x4091b5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4101e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x208
push eax
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0
push 2
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x409247
mov ecx, dword [ebp - 0x210]
cmp ecx, 4
jb 0x409247
shr ecx, 1
push 0xffffffffffffffff
cmp word [ebp + ecx*2 - 0x210], 0x5c
sete al
lea eax, [eax*2 + str.Microsoft_SharedOffice16_]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
add esp, 0x10
lea ecx, [ebp - 0x20c]
mov edx, esi
call fcn.004090f5
jmp 0x409249
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00409d37
mov esp, ebp
pop ebp
ret

Function at 0x409278
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4101e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x208
push eax
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0
push 2
push esi
push str.SoftwareMicrosoftOffice16.0CommonFilesPaths
push 0x80000002
mov edi, edx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x4092df
cmp dword [ebp - 0x210], 4
jb 0x4092df
test edi, edi
lea ecx, [ebp - 0x20c]
cmovne esi, edi
mov edx, esi
call fcn.004090f5
jmp 0x4092e1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00409d37
mov esp, ebp
pop ebp
ret

Function at 0x4093c6
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, ecx
call fcn.00409258
test eax, eax
jne 0x4093ea
mov ecx, esi
call fcn.004091b5
test eax, eax
jne 0x4093ea
mov edx, esi
mov ecx, str.mso.dll
pop esi
jmp fcn.00409278
pop esi
ret
Function at 0x40a006
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x40e220
call fcn.0040a8f2
push 1
call fcn.0040a300
pop ecx
test al, al
jne 0x409ebd
push 7
call fcn.0040a6b4
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0040a2cb
mov byte [ebp - 0x24], al
mov eax, dword [0x41045c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x409eb6
test eax, eax
jne 0x409f27
mov dword [0x41045c], ecx
push 0x40c25c
push 0x40c244
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x409f0a
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40a000
push 0x40c240
push 0x40c224
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x41045c], 2
jmp 0x409f2c
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0040a46d
pop ecx
call fcn.0040a6a8
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x409f5c
push esi
call fcn.0040a3e3
pop ecx
test al, al
je 0x409f5c
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.0040a8ec
call esi
call fcn.0040a6ae
mov esi, eax
cmp dword [esi], edi
je 0x409f7a
push esi
call fcn.0040a3e3
pop ecx
test al, al
je 0x409f7a
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.0040a7ca
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0040a7fd
test al, al
jne 0x409fa5
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x409fae
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0040a48a
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x40a000
call fcn.0040a937
ret
call fcn.00409d44
jmp 0x409e9e
Function at 0x10041526
Capabilities:
Parse pe header

Disassembly:
jmp 0x10072978
lea esp, [esp + 4]
jmp fcn.10072a22

Function at 0x10044278
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x100442b0
jmp 0x10044294
lea esp, [esp + 4]
jmp 0x1004425b
jmp 0x100442cc
jmp 0x100442e8
push ebx
jmp 0x10044304
jmp 0x10044320
push ebp
jmp 0x1004433c
jmp 0x10044358
push esi
jmp 0x10044374
jmp 0x10078028
shr edi, 0x18
movzx edi, byte [edi*4 + 0x1004dbf8]
jmp 0x10078182
and edx, esi
mov edx, dword [edx*4 + 0x1004dbf8]
jmp 0x10077eb4
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 5]
mov dword [ecx], edx
movzx edx, byte [eax + 4]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 6]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 7]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 9]
mov dword [ecx + 4], edx
movzx edx, byte [eax + 8]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xa]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xb]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xd]
mov dword [ecx + 8], edx
movzx edx, byte [eax + 0xc]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edx, 8
xor edx, esi
shl edx, 8
xor edx, eax
mov dword [ecx + 0xc], edx
mov eax, edx
shr eax, 0x10
mov esi, 0xff
and eax, esi
mov eax, dword [eax*4 + 0x1004dbf8]
xor eax, 0x1000000
mov edi, edx
shr edi, 8
and edi, esi
mov edi, dword [edi*4 + 0x1004dbf8]
and edi, 0xff0000
mov ebx, dword [ecx + 4]
and eax, 0xff000000
xor eax, edi
mov edi, edx
shr edi, 0x18
movzx edi, byte [edi*4 + 0x1004dbf8]
xor eax, edi
mov edi, edx
and edi, esi
mov edi, dword [edi*4 + 0x1004dbf8]
mov ebp, 0xff00
and edi, ebp
xor eax, edi
xor eax, dword [ecx]
lea edi, [ecx + 0x10]
xor ebx, eax
mov dword [edi], eax
mov eax, dword [ecx + 8]
xor eax, ebx
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x18], eax
xor edx, eax
mov dword [ecx + 0x1c], edx
call fcn.10064ef1
mov eax, edi
mov edx, dword [eax + 0xc]
mov ecx, edx
shr ecx, 8
mov edi, edx
and ecx, esi
mov ecx, dword [ecx*4 + 0x1004dbf8]
shr edi, 0x10
and edi, esi
mov edi, dword [edi*4 + 0x1004dbf8]
and ecx, 0xff0000
and edi, 0xff000000
xor ecx, edi
mov edi, edx
jmp 0x10077ed6
push edi
movzx edx, byte [eax]
shl edx, 8
movzx esi, byte [eax + 1]
xor edx, esi
movzx esi, byte [eax + 2]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 3]
jmp 0x10077ef4
xor ecx, edi
and edx, ebp
xor ecx, edx
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
xor ecx, dword [eax]
add ebx, 4
mov dword [edi], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
mov edx, dword [eax + 0xc]
xor edx, ecx
mov dword [eax + 0x1c], edx
cmp ebx, 0x1004f420
jne 0x10077fdc
push 0xa
pop eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100463bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1007a4e9
lea esp, [esp + 4]
jmp fcn.1007a505
Function at 0x101d129
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x101e1c0
call fcn.0101d704
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x101fd50
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x101cf3e
cmp eax, esi
jne 0x101cf31
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x101cf41
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x101cf18
xor esi, esi
inc esi
mov eax, dword [0x101fd4c]
cmp eax, esi
jne 0x101cf54
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x101cf8f
mov eax, dword [0x101fd4c]
test eax, eax
jne 0x101cf89
mov dword [0x101fd4c], esi
push 0x1001228
push 0x100121c
call fcn.0101ce95
pop ecx
pop ecx
test eax, eax
je 0x101cf8f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x101d059
mov dword [0x101fa1c], esi
mov eax, dword [0x101fd4c]
cmp eax, esi
jne 0x101cfb3
push 0x1001218
push 0x10011e4
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x101fd4c], 2
cmp dword [ebp - 0x1c], ebx
jne 0x101cfc0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x101fd5c], ebx
je 0x101cfe1
push 0x101fd5c
call fcn.0101d679
pop ecx
test eax, eax
je 0x101cfe1
push ebx
push 2
push ebx
call dword [0x101fd5c]
push dword [0x101fa04]
push dword [0x101fa08]
push dword [0x101fa00]
call fcn.0100a2d0
add esp, 0xc
mov dword [0x101fa18], eax
cmp dword [0x101fa0c], ebx
jne 0x101d03f
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x101fa1c], ebx
jne 0x101d04d
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x101fa18]
call fcn.0101d749
ret
call fcn.0101d851
jmp 0x101cef6

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40de38
mov ecx, 0x403277a7
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..text
mov ebx, 0x4304d8
nop
mov ecx, 0x5b2b27e9
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219