joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11ba1bb
Capabilities:
Encode data using xor

Disassembly:
mov ebp, dword [ebp]
push 0xc4a99b0e
push 0x598d1627
push 0xbf3742b2
lea esp, [esp + 0xc]
jmp fcn.00ea55d1
sal dword [esp + 5], 0x1c
bswap esi
jp 0x11d5149
and al, 0x56
xchg edi, eax
ficom word [ebp - 0xd]
add eax, 0x57408d17
or byte [ecx + 0xda1a9bb], dh
and esi, ecx
or eax, 0xb0cf3e65
loope 0x11ba204
push cs
out dx, al
loopne 0x11ba18f
mov dword [edi + 0x61], ebp
push esi
and eax, 0x6ae16403
sbb eax, 0xc7a5bfb5
outsd dx, dword [esi]
std
jle 0x11ba234
pop esp
int1
sub eax, 0x1171547f
pop ss
add byte [0x88404d8], bh
test byte [eax], cl
inc esi
popfd
xor esi, dword [edi - 0x30514803]
add dword [eax], ecx
inc esi
popfd
push ecx
mov dh, 0x92
inc edx
pop edx
invalid
add eax, 0x194d307a
push cs
idiv dword [ecx - 0x5401769e]
mov ebp, 0x5ab6a50c
mov byte [bx + di + 0x76], dl
mov byte [0x99db582], al
popfd
push ebx
jg 0x11ba251
jmp [eax]
sub dh, cl
inc edx
aad 0xbb
imul ebp, dword [ebp + 0x4f], 0x58ccdbb8
cdq
aam 0x90
adc eax, dword [esi + edi*2 - 0xaa15d60]
invalid
xor ebx, esi
call fcn.015a5ff0
mov dword fs:[ecx], edx
push ds
sub ch, ch
iretd

Function at 0x11da100
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xbb99082c
jmp 0x11c2e54
xor eax, 0x97f96889
mov dword [0x1135c9d5], eax
xor eax, 0x22a8c616
xor eax, 0xc6163511
test al, 0x22
les eax, [ebx + edi*8]
push ss
clc
push esp
fcompi st(5)
xchg esp, eax
and al, byte [ecx]
les ecx, [edi - 0x5861fc83]
invalid
sbb ch, byte [edi - 0x72]
invalid
aas
mov cl, 0xf9
jo 0x1185075
mov eax, 0x43bc10d2
and eax, 0x84263313
push 0x50
add bl, dh
jno 0x1185106
loop 0x11850bb
jnp 0x118507d
int 0xbb
or ebx, dword [edx]
iretd
cmp al, 0
and esi, 0x1ce1ff3f
in eax, dx
pop eax
cld
cmp eax, 0x2408119
cmpsd dword [esi], dword es:[edi]
std
pop ds
sub edx, dword [edx + 0x56]
lahf
sti
pop ds
push 0x391cd450
leave
cld
or dword [edi], ebx
cmpsb byte [esi], byte es:[edi]
and ebp, dword [ebx + 0x47eb1e0e]
shl byte [eax], 0x34
pushfd
jns 0x11851a6
jno 0x11850ca
xchg esp, eax
mov eax, dword [0x8d6bae37]
and al, 4
lea esp, [esp + 4]
jne 0xebc412
mov eax, 0xea06c73e
lea eax, [eax + eax*4 - 0x1714762]
call fcn.014d28df
mov dword [esi], 0x80848dea
sahf
mov eax, 0x8ae8fe8e
xlatb
xor al, 0
push edi
sahf
sbb ah, byte [ecx - 0x23424a05]
push edx
inc ebx
lds ecx, [edx - 0x76]
mov esp, 0xd3e9f24e
push ss
les ecx, [edi + 0x7cb61b37]
sahf
mov al, byte [0xe7b90ec2]
inc ecx
adc dword [esi + eax*4], esi
fmul qword [edx + 0x53d72ce4]
sahf
loop 0x1185146
jnp 0x1185134
imul eax, dword [edx - 0x5d133bff], 0x15
mov byte [eax], 0xf3
cld
in eax, 0xce
outsb dx, byte [esi]
shl byte [edx - 0x3c740517], cl
fimul dword [edi]
ljmp 0xccbb
movsb byte es:[edi], byte [esi]
ret
mov eax, dword [ebp + ebx*4]
push eax
push 0xd71f332f
dec ebx
not dword [esp]
jmp 0x11da113
not byte [esp + 8]
neg cl
dec cl
ror dword [esp + 5], 0x89
call fcn.00f14568
mov esi, 0xe018c726
sal si, 1
push esi
mov esp, ebp
movzx ebx, si
call fcn.00f0f5b2
jmp 0x118513a
Function at 0x11f36ed
Capabilities:
Encode data using xor

Disassembly:
jge 0xe8c5d9
out 0x8e, al
leave
push dword [edi - 0x8579a7c]
mov bh, 0x84
test al, 0xf7
out 0x69, al
mov word [ebx - 0x6c29fa7e], cs
mov dl, 0x6d
pushfd
cmpsd dword [esi], dword es:[edi]
xchg edx, eax
inc esp
sbb edx, ebp
xor dword [esi], ecx
leave
mov fs, word [edx + edx*4]
popfd
out 0xf4, al
pop edx
jb 0x11f36ef
dec ebx
test dword [eax - 0x6d], ecx
push ebx
xor eax, 0x6399a430
pop edi
test eax, 0xda7214c5
dec esi
std
and eax, 0x99578a42
mov bl, 0xfe
out dx, al
insb byte es:[edi], dx
retf

Function at 0x151eba4
Capabilities:
Encode data using xor

Disassembly:
jae 0x117d8fb
ljmp 0x78d2:0xdfab614f
dec al
mov dword [esp + esi - 0x49e00001], esi
xor bl, al
call fcn.00e9fea5
mov edx, 0xc0b5bb86
bswap edx
mov dx, word [edi]
mov ecx, 0xfab62c9f
add edi, 2
bts ecx, ecx
sub ecx, 0xda2a6c1c
movzx ecx, byte [ecx + ebp - 0x208bc083]
push 0xcd1ed43e
rol dword [esp], 0x66
adc ebp, 0
xor cl, bl
jmp 0x151eb9d
pop esp
and al, 4
and eax, 0x245c8900
add byte [ebx - 0x72f7dba4], cl
and al, 0xc
lea esp, [esp + 0x14]
ja fcn.01550aa5
jb 0x117d907
dec esi
sbb al, 0xcf
xchg dword [eax + edx], esp
xchg ah, bl
loop 0x117d8ad
push edi
aas
pushfd
add byte [esi], 0xb5
jp 0x117d98d
pop edi
mov bl, 0x62
ja 0x117d8b2
sub al, 0x5a
int3
inc edx
inc edi
inc ebp
jl 0x117d949
rcr byte [eax + 0x8f13192], cl
sti
scasd eax, dword es:[edi]
lds eax, [eax + ebp*4 + 0x2e015ead]
fnstenv [ecx + 0x924cf53]
mov byte [0x88b9673e], al
pop ss
pop ds
xchg ebx, eax
xchg esi, eax
out 0xb3, al
add al, 0xb2
inc edi
pop ss
push ebp
call 0x101a4f14
xor dword [ecx + 0x5cafaa86], ecx
add ecx, dword [ebx + 0x5061f9f6]
push eax
jns 0x117d958
or esp, dword [ebx + 0x27]
jnp 0x117d963
adc bh, 0x81
mov al, byte [0x7e404acc]
push 0x571e3
hlt
rol byte [esi - 0xd], 0xc5
sub byte [edi + 0x30], bh
jecxz 0x117d929
leave
mov dh, 0x4f
or al, 0x20
and eax, 0xdc2f0055
retf
sal word [esp + 0xe], 0x2a
xor bl, dl
shl dword [esp + 0xc], 0x70
lea edx, [esp + edx + 0x10]
push 0xdd2540a3
mov word [edx], ax
jne 0xedb76e
inc cl
call fcn.01585253
push 0xb63f6537
sar word [esp + 1], 0x26
mov eax, 0xca2abfb3
mov ax, word [edi]
adc edi, 1
mov ecx, dword [esp]
sal cl, 0x83
sbb ebp, 0
add dword [esp], ecx
sal cx, 0x83
movzx ecx, byte [ebp]
setp byte [esp]
jb 0x11b85a5
and dword [esp + 1], 0x35253ea1
push 0x4a10e4b7
sbb dl, 0xa8
mov word [esp + 2], 0x62a9
xor byte [esp + 0xe], 0xa4
sub byte [esp + 0xe], 0x37
xor dl, 0x3a
rol dl, 1
jmp 0x11e418e
Function at 0x156cecc
Capabilities:
Encode data using xor

Disassembly:
jae 0x11bda68
dec esp
adc dl, dh
jecxz 0x156cf4e
push 0xffffffffffffff9a
cld
invalid
push ebx
or eax, 0x3ee853d6
pop es
imul cl
out 0x3b, al
rol byte [edi - 0x1a6aca5a], cl
cmp byte [bx + di - 0x7b], bl
inc eax
dec edx
mov ds, esp
mov byte [eax + edx*2], dh
inc ebp
sbb dh, byte [ebp + edi*2 - 0x1a]
cmp edx, edx
inc edi
and eax, 0x301cf1d9
mov eax, 0x56a1dca8
xor eax, 0xd23be659
xchg dword [ebx], edi
or dword [ebx], eax
sub ebp, dword [esi + esi + 0xb6ee58]
push esi
xor eax, 0xd23be659
xchg dword [esi], esi
je 0x156cf6a
mov ah, 0xa4
mov ch, ah
inc ebp
jecxz 0x156cfae
adc al, 0x11
xor ah, dh
cmp edx, edx
xchg dword [eax - 0x7f0944e5], ecx
jecxz 0x156d023
pop ebx
mov eax, 0xbc7160d0
dec esi
nop
or dword [ebx - 0x2dc4195a], edx
inc edi
clc
shl byte [eax + 0x71], 1
mov esp, 0x9309904e
cmpsb byte [esi], byte es:[edi]
out 0x3b, al
rol byte [edi - 8], cl
or eax, 0x59dac664
les ebp, [ebp + 0x72dd186]
outsd dx, dword [esi]
pop edi
add dword [ebp - 0x7a7be5af], 0x6c
loope 0x156d027
adc dword [0xa66ad044], 0x2bccde1e
and ax, 0x557f
cmp dword [ecx + edx*8 + 0x158155e1], edx
mov ch, 0x38
dec edx
pop edx
sub eax, 0x9df53eba
and dword [ebp + 0xc], eax
invalid
jo 0x156cfc7
adc eax, 0x9afc1c14
dec esi
add eax, 0xff844335
sbb al, 0xfc
lcall 0xff84, 0x4335054e
invalid

Function at 0x157c3b3
Capabilities:
Encode data using xor

Disassembly:
not dl
not al
and dl, al
mov word [ebp], dx
push 0xaa9a73b
lea esp, [esp + 8]
jmp fcn.01550aa5
pop esp
ret 0xd3ff
invalid
mov dword [esp], 0x7fb4aca8
xor byte [esp + 3], 0x2e
adc ebp, 2
sar dword [esp], 0xab
jne 0x11cc2dc
dec esi
push 0x10
add cl, byte [ebx + edx*4 - 0x7f4d5541]
outsb dx, byte [esi]
jnp 0x157c3ff
sub byte [esi + 0x7b], 0x21
and dword [esi + 0x70], ebp
je 0x157c3da
outsb dx, byte [esi]
jo 0x157c455
clc
xlatb
jmp 0x157c3dd
movsd dword es:[edi], dword [esi]
aaa
lock and dword [edi - 0x2b], eax
inc edx
xchg ebx, eax
in eax, dx
jg 0x157c38a
push ecx
arpl word [esi], di
sbb al, 0x14
xor ah, bl
ret
invalid
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x4085a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x4085b5
pop dword [ebp - 0x18]
mov eax, 0x2ad237c3
add eax, 0xd56e4df2
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xd924ef2e
add dword [ebp - 0x28], 0x752d561d
mov dword [ebp - 0x24], 0xe760c23b
add dword [ebp - 0x24], 0x4ad28a0a
mov dword [ebp - 0x20], 0x98855d12
sub dword [ebp - 0x20], 0x4c3918e4
mov dword [ebp - 0x1c], 0xef0eac04
add dword [ebp - 0x1c], 0x10f153fc
lea eax, [ebp - 0x28]
push eax
mov eax, 0x1b4cb83b
sub eax, 0x1b0a87c7
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x63572a07
add dword [ebp - 0x28], 0x111b3f4f
mov dword [ebp - 0x24], 0x3507cd4f
add dword [ebp - 0x24], 0xc649426
mov dword [ebp - 0x20], 0xcc902ff8
sub dword [ebp - 0x20], 0x6920c38c
mov dword [ebp - 0x1c], 0x4f41d7bd
sub dword [ebp - 0x1c], 0x4f41d7bd
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x82d3ec67
add eax, 0x7d6e44bd
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3c8b4
push 0
call eax
mov ecx, 0x4103a623
sub ecx, 0x410362d1
xor esi, esi
add esi, eax
mov edi, 0xa65dccb6
sub edi, 0xa61a88b6
add edi, dword [ebp - 0x18]
mov edx, 0xf8811fc6
xor dword [ebp - 0x10], edx
mov ebx, dword [edi]
xor dword [ebp - 0xc], ebx
add ebx, edx
xor dword [ebp - 0x14], 0xb197f2f5
mov dword [esi], ebx
add dword [ebp - 0x10], 0x1102cecd
add esi, 0x28999a1a
add esi, 0xd76665ea
add edi, 4
loop 0x4086d3
add eax, 0xc5009ab0
add eax, 0x3b00656b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x16c15d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xfc2000]
push edi
jmp 0x16c15ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x16c15f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16c15e0
mov eax, 1
add ebx, ebx
jne 0x16c1603
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x16c1614
jne 0x16c1633
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16c1633
dec eax
add ebx, ebx
jne 0x16c1620
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x16c15f8
add ebx, ebx
jne 0x16c162f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x16c1685
xor ecx, ecx
sub eax, 3
jb 0x16c164b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x16c16ba
sar eax, 1
mov ebp, eax
jmp 0x16c1656
add ebx, ebx
jne 0x16c1656
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16c1624
inc ecx
add ebx, ebx
jne 0x16c1664
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16c1624
add ebx, ebx
jne 0x16c1671
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x16c1666
jne 0x16c1682
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x16c1666
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x16c16a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x16c1696
jmp 0x16c15e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x16c16a4
add edi, ecx
jmp 0x16c15e6
pop esi
mov edi, esi
mov ecx, 0x85dc3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x16c16c2
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x16c16c7
lea edi, [esi + 0x12bf000]
mov eax, dword [edi]
or eax, eax
je 0x16c1738
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12c177c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12c17b8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x16c16ed
mov ecx, edi
jns 0x16c171c
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12c17c0]
or eax, eax
je 0x16c1732
mov dword [ebx], eax
add ebx, 4
jmp 0x16c170a
call dword [esi + 0x12c17bc]
mov ebp, dword [esi + 0x12c17c4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1df]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x16c176c
sub esp, 0xffffff80
jmp 0x45826c
Function at 0x4345f8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043414b
Function at 0x1000b1f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x38
push ebx
push esi
push edi
mov ebx, eax
call sym.lua5.1.dll_lua_gettop
add esp, 4
sub eax, 1
mov esi, 1
je 0x1000b257
jmp 0x1000b216
mov eax, dword [esp + 0x3c]
dec eax
push ebx
push edi
mov dword [esp + 0x44], eax
call sym.lua5.1.dll_lua_type
add esp, 8
cmp eax, 3
jne 0x1000b278
test esi, esi
je 0x1000b24d
push ebx
push edi
call sym.lua5.1.dll_lua_tonumber
fstp qword [esp]
mov eax, dword [ebp + 8]
push str._.14g
push eax
call fcn.10019beb
add esp, 0x10
test eax, eax
jg 0x1000b2a5
xor esi, esi
inc ebx
cmp dword [esp + 0x3c], 0
jne 0x1000b212
call fcn.10019210
mov ebx, dword [eax]
test esi, esi
je 0x1000b2ac
push 1
push edi
call sym.lua5.1.dll_lua_pushboolean
add esp, 8
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x38]
push ecx
push ebx
push edi
call sym.lua5.1.dll_luaL_checklstring
add esp, 0xc
test esi, esi
je 0x1000b24d
mov edx, dword [ebp + 8]
mov ecx, dword [esp + 0x38]
push edx
push ecx
push 1
push eax
call fcn.1001bee0
add esp, 0x10
cmp eax, dword [esp + 0x38]
jne 0x1000b24d
mov esi, 1
jmp 0x1000b24f
push edi
call sym.lua5.1.dll_lua_pushnil
push ebx
call fcn.10019162
push eax
push 0x1003982c
push edi
call sym.lua5.1.dll_lua_pushfstring
push ebx
push edi
call sym.lua5.1.dll_lua_pushinteger
add esp, 0x1c
pop esi
mov eax, 3
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10012a70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov eax, edi
shr eax, 5
inc eax
mov ebx, edi
mov ecx, edi
cmp edi, eax
jb 0x10012aaf
jmp 0x10012a90
mov edx, dword [esp + 0x18]
movzx edx, byte [edx + ecx - 1]
mov esi, ebx
shl esi, 5
add edx, esi
mov esi, ebx
shr esi, 2
add edx, esi
sub ecx, eax
xor ebx, edx
cmp ecx, eax
jae 0x10012a90
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 8]
mov edx, dword [eax]
dec ecx
and ecx, ebx
mov ebp, dword [edx + ecx*4]
test ebp, ebp
je 0x10012b17
cmp dword [ebp + 0xc], edi
jne 0x10012b10
mov esi, dword [esp + 0x18]
mov ecx, edi
lea edx, [ebp + 0x10]
cmp edi, 4
jb 0x10012aec
mov eax, dword [esi]
cmp eax, dword [edx]
jne 0x10012b10
sub ecx, 4
add edx, 4
add esi, 4
cmp ecx, 4
jae 0x10012ad8
test ecx, ecx
je 0x10012b2e
mov al, byte [edx]
cmp al, byte [esi]
jne 0x10012b10
cmp ecx, 1
jbe 0x10012b2e
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x10012b10
cmp ecx, 2
jbe 0x10012b2e
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
je 0x10012b2e
mov ebp, dword [ebp]
test ebp, ebp
jne 0x10012ac5
mov edx, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0x18]
push edx
call fcn.100129d0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [esp + 0x14]
mov ecx, dword [edx + 0x10]
movzx edx, byte [ecx + 0x14]
mov al, byte [ebp + 5]
movzx ecx, al
not edx
and ecx, 3
test cl, dl
je 0x10012b4d
xor al, 3
mov byte [ebp + 5], al
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x100189ca
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004c008]
jne 0x100189d4
repz ret
jmp fcn.10021409
Function at 0x10027e29
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x10027e5a
call fcn.10019223
mov dword [eax], esi
call fcn.10019210
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.10022191
add esp, 0x14
push 0x16
pop eax
jmp 0x10027eaf
test dword [ebp + 0xc], 0xfffffff9
jne 0x10027e36
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10027e87
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10019236
pop ecx
call fcn.10019210
mov eax, dword [eax]
jmp 0x10027eaf
test al, 0x10
jne 0x10027ead
test al, 1
je 0x10027ead
test byte [ebp + 0xc], 2
je 0x10027ead
call fcn.10019223
mov dword [eax], 5
call fcn.10019210
mov dword [eax], 0xd
jmp 0x10027e7e
xor eax, eax
pop esi
pop ebp
ret

Function at 0x10034ec8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100225c3
and dword [ebp - 4], 0
cmp dword [0x1004e38c], 0
mov ebx, eax
jne 0x10034f79
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1003502a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1003502a
push eax
call fcn.10022551
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1004e38c], eax
call esi
push eax
call fcn.10022551
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1004e390], eax
call esi
push eax
call fcn.10022551
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1004e394], eax
call esi
push eax
call fcn.10022551
pop ecx
mov dword [0x1004e39c], eax
test eax, eax
je 0x10034f79
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10022551
pop ecx
mov dword [0x1004e398], eax
mov eax, dword [0x1004e398]
cmp eax, ebx
je 0x10034fd1
cmp dword [0x1004e39c], ebx
je 0x10034fd1
push eax
call fcn.100225cc
push dword [0x1004e39c]
mov esi, eax
call fcn.100225cc
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10034fd1
test edi, edi
je 0x10034fd1
call esi
test eax, eax
je 0x10034fc8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10034fc8
test byte [ebp - 0xc], 1
jne 0x10034fd1
or dword [ebp + 0x10], 0x200000
jmp 0x1003500a
mov eax, dword [0x1004e390]
cmp eax, ebx
je 0x1003500a
push eax
call fcn.100225cc
pop ecx
test eax, eax
je 0x1003500a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1003500a
mov eax, dword [0x1004e394]
cmp eax, ebx
je 0x1003500a
push eax
call fcn.100225cc
pop ecx
test eax, eax
je 0x1003500a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1004e38c]
call fcn.100225cc
pop ecx
test eax, eax
je 0x1003502a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1003502c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10035691
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.1003531d
push eax
push esi
push dword [ebp + 8]
call fcn.100352d2
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1003531d
push eax
push esi
push dword [ebp + 8]
call fcn.100352d2
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1003531d
push eax
push esi
push dword [ebp + 8]
call fcn.100352d2
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1003530d
stosb byte es:[edi], al
xor ch, byte [ebx + 0x7c9d882a]
invalid

Function at 0x100357a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
invalid
inc ebp
Function at 0x401000
Capabilities:
Delete registry key
Delete registry value
Persist via windows service
Set registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x43d68c]
xor eax, esp
mov dword [esp + 0x214], eax
cmp byte [0x4534f4], 0
push esi
mov dword [esp + 0xc], 0
je 0x401160
lea eax, [esp + 4]
push eax
push str.SystemCurrentControlSetServicesDbgv
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x40105b
xor al, al
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.004126a4
add esp, 0x218
ret
mov ecx, dword [esp + 4]
push str.DeleteFlag
push ecx
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [esp + 0x10]
push edx
push 4
push 0
push 0x4345cc
push eax
call esi
mov ecx, dword [esp + 4]
push 0x14
push str.System_Bus_Extender
push 1
push 0
push str.Group
push ecx
call esi
mov eax, dword [esp + 4]
push 4
lea edx, [esp + 0xc]
push edx
push 4
push 0
push 0x4345c0
push eax
mov dword [esp + 0x20], 1
call esi
mov edx, dword [esp + 4]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push 0x4345b8
push edx
call esi
push 0x4345ac
lea eax, [esp + 0x118]
push str.System32Drivers_s
push eax
call fcn.004124f2
lea eax, [esp + 0x120]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401101
sub eax, edx
mov edx, dword [esp + 4]
push eax
lea ecx, [esp + 0x118]
push ecx
push 2
push 0
push 0x43458c
push edx
call esi
mov ecx, dword [esp + 4]
push 1
lea eax, [esp + 0x224]
push eax
push 4
push 0
push 0x434580
push ecx
call esi
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.004126a4
add esp, 0x218
ret
push str.SystemCurrentControlSetServicesDbgv
lea eax, [esp + 0x14]
push 0x434578
push eax
call fcn.004124f2
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push reloc.WS2_32.dll_bind
call esi
push str.SystemCurrentControlSetServicesDbgv
lea edx, [esp + 0x14]
push 0x43456c
push edx
call fcn.004124f2
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push reloc.WS2_32.dll_bind
call esi
push str.SystemCurrentControlSetServicesDbgv
push reloc.WS2_32.dll_bind
call esi
mov ecx, dword [esp + 0x218]
pop esi
xor ecx, esp
mov al, 1
call fcn.004126a4
add esp, 0x218
ret