joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000fc70
Capabilities:
Access pe header
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000fc9f
mov eax, dword [ebp - 0x10]
jmp 0x1000fdd7
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4550
je 0x1000fcb2
mov eax, dword [ebp - 0x10]
jmp 0x1000fdd7
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], 0
jmp 0x1000fcde
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
add ecx, 0x28
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
movzx eax, word [edx + 6]
cmp dword [ebp - 0x14], eax
jae 0x1000fdc5
push 0x1001ca68
mov ecx, dword [ebp - 4]
push ecx
call sub.ntdll.dll__stricmp
add esp, 8
test eax, eax
je 0x1000fd1c
push 0x1001ca70
mov edx, dword [ebp - 4]
push edx
call sub.ntdll.dll__stricmp
add esp, 8
test eax, eax
jne 0x1000fdc0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0xc]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0xc], edx
jmp 0x1000fd39
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
add edx, dword [ecx + 8]
cmp dword [ebp - 0xc], edx
jae 0x1000fdb8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0x44
jne 0x1000fdb3
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x1c]
add eax, 4
push eax
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1000fdb3
push str.12345778_1234_ABCD_EF00_0123456789AC
lea ecx, [ebp - 0x38]
push ecx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 1
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ntdll.dll_RtlCompareUnicodeString]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1000fda9
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x3c]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], 1
jmp 0x1000fdb8
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
jmp 0x1000fd30
cmp dword [ebp - 0x20], 0
je 0x1000fdc0
jmp 0x1000fdc5
jmp 0x1000fccc
cmp dword [ebp - 0x20], 0
je 0x1000fdd4
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x10010e30
Capabilities:
Access pe header
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10010e5f
mov eax, dword [ebp - 0x10]
jmp 0x10010fc8
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4550
je 0x10010e72
mov eax, dword [ebp - 0x10]
jmp 0x10010fc8
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 4], edx
mov dword [ebp - 0x14], 0
jmp 0x10010e9e
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
add ecx, 0x28
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
movzx eax, word [edx + 6]
cmp dword [ebp - 0x14], eax
jae 0x10010fb6
push 0x1001cb2c
mov ecx, dword [ebp - 4]
push ecx
call sub.ntdll.dll__stricmp
add esp, 8
test eax, eax
je 0x10010edc
push 0x1001cb34
mov edx, dword [ebp - 4]
push edx
call sub.ntdll.dll__stricmp
add esp, 8
test eax, eax
jne 0x10010fb1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0xc]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0xc], edx
jmp 0x10010ef9
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
add edx, dword [ecx + 8]
cmp dword [ebp - 0xc], edx
jae 0x10010fa9
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0x44
jne 0x10010fa4
lea edx, [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x1c]
add eax, 4
push eax
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x10010fa4
cmp dword [0x10021378], 0x1770
jb 0x10010f54
push str.86d35949_83c9_4044_b424_db363231fd0c
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
jmp 0x10010f6f
cmp dword [0x10021378], 0xece
ja 0x10010f6f
push str.1ff70682_0a51_30e8_076d_740be8cee98b
lea edx, [ebp - 0x30]
push edx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 1
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x38]
push ecx
call dword [sym.imp.ntdll.dll_RtlCompareUnicodeString]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x10010f9a
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x3c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 1
jmp 0x10010fa9
lea ecx, [ebp - 0x38]
push ecx
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
jmp 0x10010ef0
cmp dword [ebp - 0x20], 0
je 0x10010fb1
jmp 0x10010fb6
jmp 0x10010e8c
cmp dword [ebp - 0x20], 0
je 0x10010fc5
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x10010fd0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x424], 0
xor eax, eax
mov word [ebp - 0x41c], ax
push 0x20e
push 0
lea ecx, [ebp - 0x41a]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
lea edx, [ebp - 0x41c]
mov dword [ebp - 0x428], edx
push 0x10021590
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.ntdll.dll_wcscpy]
add esp, 8
push 0x1001cc58
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.ntdll.dll_wcscat]
add esp, 8
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea ecx, [ebp - 0x430]
push ecx
push 0x210
mov edx, dword [ebp - 0x428]
push edx
push 0x1b
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_ZwQueryInformationProcess]
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
jl 0x10011132
push 1
mov eax, dword [ebp - 0x428]
push eax
lea ecx, [ebp - 0x438]
push ecx
call dword [sym.imp.ntdll.dll_RtlCompareUnicodeString]
test eax, eax
jne 0x10011132
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
je 0x10011132
push 0x1001cc74
mov edx, dword [ebp - 0x420]
push edx
call fcn.10001000
add esp, 8
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jne 0x100110f6
push 0x1001cc7c
mov eax, dword [ebp - 0x420]
push eax
call fcn.10001000
add esp, 8
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
je 0x10011132
mov ecx, dword [ebp - 0x420]
add ecx, 6
mov dword [ebp - 0x420], ecx
push 7
push str.netsvcs
mov edx, dword [ebp - 0x420]
push edx
call fcn.100072ab
add esp, 0xc
test eax, eax
jne 0x10011132
mov dword [ebp - 0x424], 1
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001162
mov esp, ebp
pop ebp
ret
Function at 0x100112f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
cmp dword [0x1002189c], 0
jne 0x1001130e
mov eax, dword [ebp - 4]
jmp 0x100113f1
lea eax, [ebp - 8]
push eax
push 0x40
push 0x50
mov ecx, dword [0x1002189c]
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x10011331
mov eax, dword [ebp - 4]
jmp 0x100113f1
mov edx, 4
imul eax, edx, 0x13
mov ecx, dword [0x1002189c]
mov edx, dword [0x100218b0]
mov dword [ecx + eax], edx
mov eax, 4
shl eax, 0
mov ecx, dword [0x1002189c]
mov edx, dword [0x100218b4]
mov dword [ecx + eax], edx
mov eax, 4
imul ecx, eax, 0xe
mov edx, dword [0x1002189c]
mov eax, dword [0x100218a4]
mov dword [edx + ecx], eax
mov ecx, 4
imul edx, ecx, 0xc
mov eax, dword [0x1002189c]
mov ecx, dword [0x10021894]
mov dword [eax + edx], ecx
mov edx, 4
imul eax, edx, 0xb
mov ecx, dword [0x1002189c]
mov edx, dword [0x1002188c]
mov dword [ecx + eax], edx
mov eax, 4
imul ecx, eax, 0xa
mov edx, dword [0x1002189c]
mov eax, dword [0x100218bc]
mov dword [edx + ecx], eax
mov ecx, 4
imul edx, ecx, 0xd
mov eax, dword [0x1002189c]
mov ecx, dword [0x100218a0]
mov dword [eax + edx], ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 8]
push eax
push 0x50
mov ecx, dword [0x1002189c]
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100116b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x214], ax
push 0x20e
push 0
lea ecx, [ebp - 0x212]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
mov edx, dword [ebp + 8]
push edx
push str.REGISTRYMACHINESYSTEMCurrentControlSet_services_
push str._s_s
push 0x108
lea eax, [ebp - 0x214]
push eax
call fcn.100010f0
add esp, 0x14
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x254]
push edx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [ebp - 0x24c], 0x18
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x240], 0x40
lea eax, [ebp - 0x254]
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0
lea ecx, [ebp - 0x24c]
push ecx
push 1
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.ntdll.dll_ZwOpenKey]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jl 0x100118e2
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x218], 0
push 0x100
call fcn.1000119c
add esp, 4
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x100117e6
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ntdll.dll_ZwClose]
mov eax, 0x5aa
jmp 0x100118e4
cmp dword [ebp + 0x10], 0
je 0x10011850
push str.Start
lea edx, [ebp - 0x230]
push edx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x224]
push eax
push 0x100
mov ecx, dword [ebp - 0x218]
push ecx
push 2
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ntdll.dll_ZwQueryValueKey]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jl 0x10011850
mov ecx, dword [ebp - 0x218]
cmp dword [ecx + 4], 4
jne 0x10011850
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax + 0xc]
mov dword [edx], ecx
cmp dword [ebp + 0xc], 0
je 0x100118ba
push str.Type
lea edx, [ebp - 0x230]
push edx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x224]
push eax
push 0x100
mov ecx, dword [ebp - 0x218]
push ecx
push 2
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ntdll.dll_ZwQueryValueKey]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jl 0x100118ba
mov ecx, dword [ebp - 0x218]
cmp dword [ecx + 4], 4
jne 0x100118ba
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax + 0xc]
mov dword [edx], ecx
mov edx, dword [ebp - 0x218]
mov dword [ebp - 0x234], edx
mov eax, dword [ebp - 0x234]
push eax
call fcn.10001171
add esp, 4
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ntdll.dll_ZwClose]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001162
mov esp, ebp
pop ebp
ret
Function at 0x100138f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
cmp dword [0x100218c4], 0
jne 0x1001390e
mov eax, dword [ebp - 4]
jmp 0x10013a37
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.1000bfa0
add esp, 4
test eax, eax
jne 0x10013929
mov eax, dword [ebp - 4]
jmp 0x10013a37
lea eax, [ebp - 8]
push eax
push 0x40
push 0xf0
mov ecx, dword [0x100218c4]
push ecx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x1001394f
mov eax, dword [ebp - 4]
jmp 0x10013a37
mov edx, 4
imul eax, edx, 0x1f
mov ecx, dword [0x100218c4]
mov edx, dword [0x100218e0]
mov dword [ecx + eax], edx
mov eax, 4
imul ecx, eax, 0x13
mov edx, dword [0x100218c4]
mov eax, dword [0x100218d4]
mov dword [edx + ecx], eax
mov ecx, 4
imul edx, ecx, 0xc
mov eax, dword [0x100218c4]
mov ecx, dword [0x100218d0]
mov dword [eax + edx], ecx
mov edx, 4
shl edx, 4
mov eax, dword [0x100218c4]
mov ecx, dword [0x100218dc]
mov dword [eax + edx], ecx
mov edx, 4
imul eax, edx, 0x18
mov ecx, dword [0x100218c4]
mov edx, dword [0x100218c8]
mov dword [ecx + eax], edx
mov eax, 4
imul ecx, eax, 0x1c
mov edx, dword [0x100218c4]
mov eax, dword [0x100218d8]
mov dword [edx + ecx], eax
mov ecx, 4
imul edx, ecx, 0xb
mov eax, dword [0x100218c4]
mov ecx, dword [0x100218cc]
mov dword [eax + edx], ecx
mov edx, 4
imul eax, edx, 0x17
mov ecx, dword [0x100218c4]
mov edx, dword [0x100218e4]
mov dword [ecx + eax], edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0xf0
mov edx, dword [0x100218c4]
push edx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.1000bf30
add esp, 4
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10013a40
Capabilities:
Access pe header
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x14], 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov dword [0x100218c4], 0
cmp dword [ebp - 0x1c], 0
jne 0x10013a77
mov eax, dword [ebp - 0x14]
jmp 0x10013bc2
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10013a92
mov eax, dword [ebp - 0x14]
jmp 0x10013bc2
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x14]
mov eax, dword [ebp - 8]
lea ecx, [eax + edx + 0x18]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], 0
jmp 0x10013abe
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
add eax, 0x28
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x18], edx
jae 0x10013ba5
push 0x1001d058
mov eax, dword [ebp - 4]
push eax
call sub.ntdll.dll__stricmp
add esp, 8
test eax, eax
je 0x10013afc
push 0x1001d060
mov ecx, dword [ebp - 4]
push ecx
call sub.ntdll.dll__stricmp
add esp, 8
test eax, eax
jne 0x10013ba0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0xc]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0xc], ecx
jmp 0x10013b19
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x28]
add ecx, dword [eax + 8]
cmp dword [ebp - 0xc], ecx
jae 0x10013b98
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
cmp dword [eax], 0x44
jne 0x10013b93
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x24]
add edx, 4
push edx
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x10013b93
push str.367abb81_9844_35f1_ad32_98f038001003
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 1
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.ntdll.dll_RtlCompareUnicodeString]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10013b89
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x10], 1
jmp 0x10013b98
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
jmp 0x10013b10
cmp dword [ebp - 0x10], 0
je 0x10013ba0
jmp 0x10013ba5
jmp 0x10013aac
cmp dword [ebp - 0x10], 0
jne 0x10013bad
jmp 0x10013bb9
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 4]
mov dword [0x100218c4], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x10014940
Capabilities:
Access pe header
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1001496f
mov eax, dword [ebp - 0x20]
jmp 0x10014a94
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x14]
mov eax, dword [ebp - 8]
lea ecx, [eax + edx + 0x18]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], 0
jmp 0x1001499b
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
add eax, 0x28
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x10], edx
jae 0x10014a82
push str..text
mov eax, dword [ebp - 4]
push eax
call sub.ntdll.dll__stricmp
add esp, 8
test eax, eax
je 0x100149d9
push str..rdata
mov ecx, dword [ebp - 4]
push ecx
call sub.ntdll.dll__stricmp
add esp, 8
test eax, eax
jne 0x10014a7d
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0xc]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0xc], ecx
jmp 0x100149f6
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x24]
add ecx, dword [eax + 8]
cmp dword [ebp - 0xc], ecx
jae 0x10014a75
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0x44
jne 0x10014a70
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x18]
add edx, 4
push edx
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x10014a70
push str.5ca4a760_ebb1_11cf_8611_00a0245420ed
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 1
lea ecx, [ebp - 0x38]
push ecx
lea edx, [ebp - 0x30]
push edx
call dword [sym.imp.ntdll.dll_RtlCompareUnicodeString]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10014a66
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], 1
jmp 0x10014a75
lea edx, [ebp - 0x30]
push edx
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
jmp 0x100149ed
cmp dword [ebp - 0x1c], 0
je 0x10014a7d
jmp 0x10014a82
jmp 0x10014989
cmp dword [ebp - 0x1c], 0
je 0x10014a91
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret

Function at 0x100164b0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp + 8]
mov dword [ecx + eax], 0x67452301
mov edx, 4
shl edx, 0
mov eax, dword [ebp + 8]
mov dword [eax + edx], 0xefcdab89
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x98badcfe
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp + 8]
mov dword [edx + ecx], 0x10325476
pop ebp
ret
Function at 0x4064e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x40650c
xor eax, eax
test eax, eax
je 0x40651f
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40651f
xor ecx, ecx
jmp 0x406522
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406609
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x406640
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40661a
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x406615
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406671
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x406653
pop edi
not eax
pop esi
ret 0xc

Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
mov bl, byte [edx]
cmp esi, eax
push ss
sbb dword [ebx], ecx
insb byte es:[edi], dx
test eax, 0xe17bc5af
cmp dword [ebx + edi*2 - 0xa], ebx
sbb dword [edi], ebx
insb byte es:[edi], dx
or eax, 0xb17bc590
cmp al, byte [eax + ecx - 0x924efe6]
or eax, 0xc7f690d1
push 0xffffffffffffffdd
dec eax
sar byte [ecx + 0x1c50cce], cl
adc bl, bl
test byte [0xc7f690d1], 0x6a
fisttp qword [eax - 0xe]
sar byte [ecx + 0x1c50cce], cl
leave
xchg byte [edi], bh
insb byte es:[edi], dx
std
lodsd eax, dword [esi]
lds edi, [ebx - 0x40]
xor byte [esi], dh
test byte [ebx + edi*2 - 0x21], bl
pop esp
jnp 0x414aa2
pop esp
jnp 0x414aa2
inc edx
or al, 0x22
imul eax, ebp, 9
push edx
push esp
jnp 0x414a84
cmp ch, dh
call [edx]
inc eax
inc ecx
test dword [0x34ad6c6a], 0xf2b07bc4
stosb byte es:[edi], al
ror byte [ecx], 0x48
adc al, 0x4d
xor byte [ecx + ebp*2 + 0x596c3ab3], 0xd
lds edi, [ebx - 0x1f]
test eax, 0x4af67bc5
sub ah, ah
dec eax
rcl byte [ebp - 0x71], cl
or eax, 0xf2ca4dc5
cmp al, byte [ecx + ecx + 0x9843af2]
cmp al, byte [ecx + ecx - 0x97bc50e]
or eax, 0xf2097bc5
cmp al, byte [esi + esi*8 + 0x97bc50d]
cmp al, byte [ecx + ecx + 0x9843af2]
cmp al, byte [ecx + ecx + 0x516852f2]
mov dh, 0x3a
ret
Function at 0x40a4c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x412250], 0
push esi
push edi
jne 0x40a436
call fcn.0040a3a2
test eax, eax
je 0x40a47b
mov eax, dword [0x412250]
cmp eax, 1
jne 0x40a457
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40a47b
jmp 0x40a4bd
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x40a4bd
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40a47f
xor eax, eax
jmp 0x40a4bd
mov eax, dword [esi]
push dword [0x412250]
call edi
mov edi, eax
test edi, edi
je 0x40a4a1
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x40a4bd
lea edi, [esi + 0xff0]
push esi
push dword [0x412250]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x40a4a7
mov eax, esi
pop edi
pop esi
ret
jmp 0x40a422

Function at 0x40a788
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412120]
jne 0x40a792
repz ret
jmp fcn.0040adba

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx