joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ba304
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4ba43a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [esi + 0x3cc], 0
je 0x4ba415
lea eax, [ebp - 4]
mov edx, dword [esi + 0x3d4]
call fcn.00404bc4
xor edx, edx
mov eax, dword [esi + 0x384]
call fcn.00451278
mov ebx, 0xb
lea eax, [ebp - 8]
mov ecx, 0x4ba450
mov edx, dword [ebp - 4]
call fcn.00404e44
mov eax, dword [ebp - 8]
call fcn.004098f0
test al, al
je 0x4ba391
lea eax, [ebp - 0xc]
mov ecx, 0x4ba450
mov edx, dword [ebp - 4]
call fcn.00404e44
mov eax, dword [ebp - 0xc]
call fcn.00404fbc
push eax
call sub.kernel32.dll_DeleteFileA
push 0x64
call sub.kernel32.dll_Sleep_2
dec ebx
jne 0x4ba34d
mov ebx, 0xb
mov eax, dword [ebp - 4]
call fcn.004098f0
test al, al
je 0x4ba3ba
mov eax, dword [ebp - 4]
call fcn.00404fbc
push eax
call sub.kernel32.dll_DeleteFileA
push 0x64
call sub.kernel32.dll_Sleep_2
dec ebx
jne 0x4ba396
mov ebx, 0xb
lea eax, [ebp - 0x10]
mov ecx, 0x4ba468
mov edx, dword [ebp - 4]
call fcn.00404e44
mov eax, dword [ebp - 0x10]
call fcn.004098f0
test al, al
je 0x4ba40c
mov eax, dword [ebp - 4]
call fcn.00404fbc
push eax
lea eax, [ebp - 0x14]
mov ecx, 0x4ba468
mov edx, dword [ebp - 4]
call fcn.00404e44
mov eax, dword [ebp - 0x14]
call fcn.00404fbc
push eax
call sub.kernel32.dll_MoveFileA
push 0x64
call sub.kernel32.dll_Sleep_2
dec ebx
jne 0x4ba3bf
mov byte [esi + 0x3cc], 0
jmp 0x4ba41f
mov eax, 0x4ba480
call fcn.00442830
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ba441
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404b50
ret
Function at 0x403370
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x427597
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov dword [esp + 0xc], 0
mov dword [esp + 0x18], 1
mov eax, dword [0x434554]
mov dword [esp + 4], eax
lea ecx, [esp + 4]
mov byte [esp + 0x18], 3
call fcn.0041b616
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
push ecx
push 0x104
push 0x104
lea ecx, [esp + 0x10]
call fcn.0041ba8e
push eax
push 0x4343c4
push esi
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x104
lea ecx, [esp + 8]
call fcn.0041badd
lea ecx, [esp + 4]
call fcn.004194ea
lea ecx, [esp + 4]
call fcn.0041949e
lea ecx, [esp + 4]
call fcn.0042581c
push eax
lea ecx, [esp + 0xc]
call fcn.0041b74b
mov esi, dword [esp + 0x20]
lea edx, [esp + 8]
push edx
mov ecx, esi
mov byte [esp + 0x1c], 4
call fcn.0041b400
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x18], 3
call fcn.0041b68b
lea ecx, [esp + 4]
mov byte [esp + 0x18], 2
call fcn.0041b68b
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], 1
call fcn.0041b68b
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], 0
call fcn.0041b68b
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x4115ad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x435af0
cmp edx, dword [eax]
je 0x4115cf
add eax, 8
inc ecx
cmp eax, 0x435b80
jl 0x4115c0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x435af0]
jne 0x4116fd
mov eax, dword [0x43855c]
cmp eax, 1
je 0x4116d7
test eax, eax
jne 0x411600
cmp dword [0x4352e4], 1
je 0x4116d7
cmp edx, 0xfc
je 0x4116fd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x411637
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00411700
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040fd20
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41167a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040fd20
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x42cc0c
push edi
call fcn.0040bc80
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00411700
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00411710
lea eax, [ebp - 0xa0]
push 0x42cbec
push eax
call fcn.00411710
push dword [esi + 0x435af4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00411710
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004141cb
add esp, 0x2c
pop edi
jmp 0x4116fd
lea eax, [ebp + 8]
lea esi, [esi + 0x435af4]
push 0
push eax
push dword [esi]
call fcn.0040fd20
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4188d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0040b600
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x41899b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x41899b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x41894e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x418959
or bh, 8
and edi, 0x8000000
je 0x418974
mov eax, dword [0x439cfc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x41899b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e07c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x41e0be
call fcn.0042341c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x41e0be
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x41e0b5
xor eax, eax
jmp 0x41e0c6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0041e0cc
pop edi
pop esi
pop ebx
ret 4

Function at 0x422605
Capabilities:
Create http request

Disassembly:
mov eax, 0x427c50
call fcn.0040c00c
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x42263d
call fcn.0042341c
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x422662
push eax
push dword [esi + 4]
call fcn.00422797
jmp 0x42266e
push esi
push eax
mov ecx, 0x4381f0
call fcn.0042267f
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x423cd5
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x423d03
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x423d21
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00423c3b
jmp 0x423d21
mov eax, dword [esi + 0x14]
test eax, eax
je 0x423d21
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00423c3b
test edi, edi
mov eax, edi
jne 0x423d0b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x426443
Capabilities:
Receive data
Receive data on socket

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx + 4]
call sub.WSOCK32.dll_recv
ret 0xc

Function at 0x42645a
Capabilities:
Send data
Send data on socket

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [ecx + 4]
call sub.WSOCK32.dll_send
ret 0xc
Function at 0x4025f0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [esp + 4]
push eax
push edi
mov dword [esp + 0xc], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x402666
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push esi
mov esi, dword [sym.imp.MSVCRT.dll__stricmp]
call ebx
cmp dword [esp + 0x14], eax
jne 0x402639
mov ecx, dword [esp + 0x24]
mov dword [0x4063e8], ecx
lea edx, [esp + 0x30]
push str.explorer.exe
push edx
call esi
add esp, 8
test eax, eax
jne 0x402655
mov eax, dword [esp + 0x14]
mov dword [0x4063e4], eax
lea ecx, [esp + 0xc]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402627
pop esi
pop ebx
pop edi
add esp, 0x128
ret
Function at 0x70300a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.007038d9
add esp, 0xc
jnp 0x703025
lea ecx, [ecx + 0x4321]
sub ecx, 0x4321
shr edx, 0
jae 0x703041
xchg ecx, eax
xchg ecx, eax
xchg ebx, ecx
xchg ebx, ecx
mov edi, edi
jb 0x703041
sub eax, 0x4aec45c6
mov byte [ebp - 0x14], 0x4a
mov byte [ebp - 8], 0x63
mov byte [ebp - 0xb], 0x6a
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 6], 0x66
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0x11], 0x6a
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xc], 0x57
mov byte [ebp - 9], 0x6a
mov byte [ebp - 7], 0x6d
rol esi, 0xa
rol esi, 0x16
ror ecx, 0
dec edx
inc edx
jp 0x703097
jne 0x703090
mov esp, esp
jnp 0x703094
jnp 0x703097
ljmp 0x1e9:0x80ec4d8a
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 6]
sub dl, 1
mov byte [ebp - 6], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xa]
sub cl, 1
mov byte [ebp - 0xa], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 8]
sub cl, 1
mov byte [ebp - 8], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
call fcn.0070cc92
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x70312b
xor eax, eax
jmp 0x703191
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00702f41
mov dword [ebp - 0x18], eax
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.007038d9
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x70318f
jne 0x703153
xchg esp, esp
jb 0x703157
add edx, 0x7272
sub edx, 0x7272
jne 0x70316a
js 0x703167
je 0x70316a
xor eax, 0x51e84d8b
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00723150
add esp, 4
sub esp, 0
jnp 0x703186
jbe 0x70317d
jge 0x70317f
js 0x703181
jp 0x703186
mov ecx, 0x558b8ab2
or byte [edx - 1], dl
push ebp
call 0xc0a3347c
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x703191
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x70693b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.007038d9
add esp, 0xc
cmc
jg 0x706964
pushf
nop
nop
popf
je 0x70695f
jle 0x706961
jle 0x706964
mov ebp, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
neg edi
neg edi
jl 0x7069b9
jbe 0x7069b4
jl 0x7069b6
jge 0x7069b9
lcall 0x1e9, 0x80e44d8a
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.007116a4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x706a6a
xor eax, eax
jmp 0x706aed
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00702f41
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.007038d9
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x706aeb
xor esi, dword [esp + 0x10]
xor esi, dword [esp + 0x10]
jae 0x706aa5
pushf
ja 0x706a9e
popf
mov ecx, ecx
jb 0x706aa5
or dword [ebx - 0x17ae03b3], 0x1c6a2
mov ecx, dword [ebp - 4]
push ecx
call fcn.00723150
add esp, 4
rol esi, 9
ror esi, 9
or esp, 0
xchg edi, ebx
xchg edi, ebx
jle 0x706ad2
pushf
sub esi, 0
je 0x706ac7
jmp 0x706ac9
popf
jb 0x706acd
jns 0x706acf
jg 0x706ad2
add eax, 0x5218558b
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x706aed
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x707836
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.007038d9
add esp, 0xc
jnp 0x707851
jge 0x707853
test esp, 0x3e14
mov ebx, ebx
jle 0x707866
xchg ecx, edi
xchg ecx, edi
xchg ecx, ecx
jg 0x707866
mov ebp, 0x48ec45c6
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 0xf], 0x70
mov byte [ebp - 0xa], 0x55
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x6a
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6e
mov byte [ebp - 0x11], 0x51
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0
cmc
lea esp, [esp]
js 0x7078bb
pushf
mov esp, esp
cmp edx, ecx
popf
jp 0x7078b6
jne 0x7078b8
jns 0x7078bb
mov ecx, 0x80ec4d8a
jmp 0xecbe00c5
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 9]
sub al, 1
mov byte [ebp - 9], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
call fcn.007116a4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x707952
xor eax, eax
jmp 0x707a0b
call fcn.00707957
Function at 0x70c99a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.007038d9
add esp, 0xc
push 0x21
push 0x6f9d58
lea ecx, [ebp - 0x138]
push ecx
call fcn.00706af6
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x70caa2
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.007038d9
add esp, 0xc
push 0xb
push 0x6f9d7c
lea edx, [ebp - 0x138]
push edx
call fcn.00706af6
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x70ca95
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00706af6
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x70caa4
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x710055
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.007038d9
add esp, 0xc
test esi, 0x347b
jp 0x710082
jne 0x710078
lea edx, [edx]
jbe 0x71007c
jne 0x71007e
jnp 0x710082
add eax, 0xe845c63e
inc edi
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0xe], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x13], 0x6a
mov byte [ebp - 0xc], 0x42
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x70
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0xf], 0x78
mov byte [ebp - 0x17], 0x6a
mov byte [ebp - 0xd], 0x79
add esi, 0
inc edi
dec edi
jo 0x7100ca
jae 0x7100c3
xchg esp, esp
jl 0x7100c7
jno 0x7100ca
call 0x81594e58
jmp 0xe8be88d4
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
call fcn.0070cc92
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x71014d
xor eax, eax
jmp 0x7101cb
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00702f41
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.007038d9
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x7101c9
push ecx
add ecx, 0x7c1c
ror ecx, 2
pop ecx
rol esp, 0
rol esp, 0
shl edx, 0
jb 0x71018e
jle 0x71018b
jae 0x71018e
mov ebp, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.00723150
add esp, 4
jae 0x71019c
add edx, 0x478b
sub edx, 0x478b
jge 0x7101b4
mov esp, esp
jbe 0x7101ae
xchg esi, esi
jl 0x7101b4
ljmp 0x8b50:0x14458bc4
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x7101cb
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x7108d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.007038d9
add esp, 0xc
or esp, 0
mov esp, esp
js 0x710925
pushf
cmp esp, 0x49d5
cmp ebx, dword [esp + 8]
jno 0x71090d
shl ebx, 0
popf
lea eax, [eax + 0x2132]
lea eax, [eax - 0x2132]
jno 0x710920
xchg esp, esp
jns 0x710925
mov esi, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
stc
je 0x7109da
ja 0x7109d3
ja 0x7109d5
jp 0x7109d7
jne 0x7109da
add eax, 0xcc5e8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.007116a4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x7109ef
xor eax, eax
jmp 0x710a76
jo 0x7109f1
ror esp, 0
jbe 0x710a0f
pushf
not ebx
not ebx
jns 0x7109fe
jne 0x710a00
shl esp, 0
popf
jno 0x710a07
lea esp, [esp]
jno 0x710a0c
ja 0x710a0f
mov esp, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.00702f41
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.007038d9
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x710a39
xor eax, eax
jmp 0x710a76
cmp ecx, dword [esp + 0x10]
je 0x710a4d
jbe 0x710a41
mov esp, esp
lea esp, [esp]
mov edx, edx
jne 0x710a4d
lcall 0x52fc, 0x558bbc99
mov edx, dword [ebp - 4]
push edx
call fcn.00723150
add esp, 4
add eax, 0
test dword [esp + 4], edx
cld
jle 0x710a6b
xchg edi, ecx
xchg edi, ecx
jg 0x710a6b
add eax, 0xc458bda
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8