joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407430
Capabilities:
Set registry value

Disassembly:
push 0xb0
mov eax, 0x40d7eb
call fcn.0040d394
mov dword [ebp - 0x20], ecx
mov ebx, dword [ebp + 8]
xor eax, eax
xor ecx, ecx
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], edi
mov word [ebx], ax
mov eax, dword [ebp + 0x10]
mov word [eax], cx
lea eax, [ebp - 0x10]
push eax
push 0x2001f
push edi
push 0x401af8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4075c8
mov esi, dword [ebp + 0x18]
mov eax, edi
cmp dword [esi], eax
je 0x40748f
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi], edi
mov ecx, dword [ebp - 0x10]
mov dword [esi], ecx
test eax, eax
jne 0x4075c8
lea ecx, [ebp - 0xbc]
call fcn.004053f5
lea ecx, [ebp - 0xbc]
mov dword [ebp - 4], edi
call fcn.00405550
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4075b9
lea eax, [ebp - 0x10]
push eax
call fcn.00407f54
mov ecx, 0x401bc8
mov edi, dword [eax]
mov eax, dword [edi + 0x14]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4074fb
test dx, dx
je 0x4074f7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4074fb
add eax, 4
add ecx, 4
test dx, dx
jne 0x4074d5
xor eax, eax
jmp 0x407500
sbb eax, eax
or eax, 1
test eax, eax
je 0x4075af
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
push dword [edi]
call fcn.00405822
test eax, eax
jne 0x4075af
mov eax, dword [ebp - 0x14]
test al, 2
je 0x4075af
mov ecx, dword [ebp - 0x20]
and eax, 0xfffffffd
push 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 4
xor eax, eax
mov dword [ecx + 0x80], 1
push eax
push dword [edi]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test byte [ebp - 0x14], 1
je 0x407580
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1c]
jne 0x40755e
sub ecx, edx
sar ecx, 1
je 0x40757c
push 0x401c48
mov ecx, ebx
call fcn.00408052
mov ecx, ebx
jmp 0x4075a8
mov ecx, dword [ebp + 0x10]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1c]
jne 0x407586
sub ecx, edx
sar ecx, 1
je 0x4075a5
mov ecx, dword [ebp + 0x10]
push 0x401c48
call fcn.00408052
mov ecx, dword [ebp + 0x10]
push dword [edi]
call fcn.00408052
cmp dword [ebp - 0x10], 0
jne 0x4074c2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc]
call fcn.00405470
call fcn.0040d362
ret 0x14
Function at 0x408171
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c4
mov eax, dword [0x40f314]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, 0xa2
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
movzx ebx, ax
mov eax, 0xa3
push eax
shr ebx, 0xf
call dword [sym.imp.USER32.dll_GetKeyState]
mov esi, 0x8000
push 2
pop edx
test si, ax
je 0x4081b6
or ebx, edx
mov eax, 0xa4
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x4081ca
or ebx, 4
mov eax, 0xa5
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x4081de
or ebx, 8
mov eax, 0xa0
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x4081f2
or ebx, 0x10
mov eax, 0xa1
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x408206
or ebx, 0x20
push 0x1c0
lea eax, [ebp - 0x1c4]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor edi, edi
xor ecx, ecx
inc edi
mov edx, 0x1000
push 2
pop esi
test bl, 1
je 0x40824e
mov eax, 0xa2
mov dword [ebp - 0x1c4], edi
mov word [ebp - 0x1c0], ax
mov ecx, edi
mov dword [ebp - 0x1bc], esi
mov dword [ebp - 0x1b4], edx
test bl, 2
je 0x408280
imul eax, ecx, 0x1c
mov esi, 0xa3
push 2
inc ecx
mov word [ebp + eax - 0x1c0], si
mov dword [ebp + eax - 0x1c4], edi
mov dword [ebp + eax - 0x1bc], 3
mov dword [ebp + eax - 0x1b4], edx
pop esi
test bl, 4
je 0x4082ae
imul eax, ecx, 0x1c
mov esi, 0xa4
push 2
inc ecx
mov word [ebp + eax - 0x1c0], si
pop esi
mov dword [ebp + eax - 0x1c4], edi
mov dword [ebp + eax - 0x1bc], esi
mov dword [ebp + eax - 0x1b4], edx
test bl, 8
je 0x4082e0
imul eax, ecx, 0x1c
mov esi, 0xa5
push 2
inc ecx
mov word [ebp + eax - 0x1c0], si
mov dword [ebp + eax - 0x1c4], edi
mov dword [ebp + eax - 0x1bc], 3
mov dword [ebp + eax - 0x1b4], edx
pop esi
test bl, 0x10
je 0x40830e
imul eax, ecx, 0x1c
inc ecx
mov dword [ebp + eax - 0x1c4], edi
mov edi, 0xa0
mov word [ebp + eax - 0x1c0], di
xor edi, edi
mov dword [ebp + eax - 0x1bc], esi
inc edi
mov dword [ebp + eax - 0x1b4], edx
test bl, 0x20
je 0x408339
imul eax, ecx, 0x1c
mov ebx, 0xa1
inc ecx
mov dword [ebp + eax - 0x1c4], edi
mov word [ebp + eax - 0x1c0], bx
mov dword [ebp + eax - 0x1bc], esi
mov dword [ebp + eax - 0x1b4], edx
imul eax, ecx, 0x1c
mov ebx, 0x1000
push 0x5b
pop esi
push 0x55
and dword [ebp + eax - 0x1bc], 0
inc ecx
mov dword [ebp + eax - 0x1b4], edx
mov dword [ebp + eax - 0x1c4], edi
mov word [ebp + eax - 0x1c0], si
imul eax, ecx, 0x1c
pop edx
push 2
and dword [ebp + eax - 0x1bc], 0
inc ecx
mov word [ebp + eax - 0x1c0], dx
mov dword [ebp + eax - 0x1c4], edi
mov dword [ebp + eax - 0x1b4], ebx
imul eax, ecx, 0x1c
inc ecx
mov word [ebp + eax - 0x1c0], dx
mov dword [ebp + eax - 0x1c4], edi
pop edx
mov dword [ebp + eax - 0x1bc], edx
mov dword [ebp + eax - 0x1b4], ebx
imul eax, ecx, 0x1c
push 0x1c
mov dword [ebp + eax - 0x1c4], edi
mov word [ebp + eax - 0x1c0], si
mov dword [ebp + eax - 0x1bc], edx
mov dword [ebp + eax - 0x1b4], ebx
lea eax, [ebp - 0x1c4]
push eax
lea eax, [ecx + 1]
push eax
call dword [sym.imp.USER32.dll_SendInput]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c9b0
mov esp, ebp
pop ebp
ret
Function at 0x408a08
Capabilities:
Enumerate process modules

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x222c
call fcn.0040d470
mov eax, dword [0x40f314]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, edx
mov dword [ebp - 0x2224], ecx
push edi
mov dword [ebp - 0x2228], eax
xor edi, edi
mov dword [eax], edi
lea eax, [ebp - 0x2210]
push eax
push 0x2000
lea eax, [ebp - 0x220c]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x408b7e
mov eax, dword [ebp - 0x2210]
mov ecx, 0x800
shr eax, 2
mov dword [ebp - 0x2210], eax
cmp eax, ecx
jbe 0x408a74
mov dword [ebp - 0x2210], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
mov dword [ebp - 0x2214], edi
lea eax, [ebp - 0x2214]
mov dword [ebp - 0x2218], ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x408b7e
push esi
mov esi, edi
cmp dword [ebp - 0x2210], esi
jbe 0x408b79
lea eax, [ebp - 0x221c]
push eax
push dword [ebp + esi*4 - 0x220c]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x408b5b
mov eax, dword [ebp - 0x221c]
cmp eax, dword [ebp - 0x2214]
jne 0x408b5b
cmp ebx, dword [ebp + esi*4 - 0x220c]
je 0x408b5b
push dword [ebp + esi*4 - 0x220c]
push edi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x408b55
lea eax, [ebp - 0x222c]
push eax
push 4
lea eax, [ebp - 0x2220]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x408b4e
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x2220]
push ebx
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x408b4e
push dword [ebp - 0x2224]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x408b6a
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x2218]
inc esi
cmp esi, dword [ebp - 0x2210]
jb 0x408aad
jmp 0x408b79
mov eax, dword [ebp - 0x2228]
mov edi, dword [ebp + esi*4 - 0x220c]
mov dword [eax], ebx
mov eax, edi
pop esi
jmp 0x408b80
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0040c9b0
mov esp, ebp
pop ebp
ret 4

Function at 0x408bbd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push esi
push 0
push 2
push dword [ebp + 8]
mov dword [ebp - 4], 0x208
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x408bef
xor ecx, ecx
mov word [esi], cx
pop esi
test eax, eax
jle 0x408bfc
movzx eax, ax
or eax, 0x80070000
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4091e0
Capabilities:
Query environment variable

Disassembly:
push 0x210
mov eax, 0x40dacb
call fcn.0040d3c7
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], ecx
push eax
push 0x402454
push 0x17
push ecx
push 0x402d10
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
js 0x4092a9
mov eax, dword [ebp - 0x21c]
push 2
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x410410]
call esi
mov edi, eax
test edi, edi
js 0x4092a9
mov ecx, dword [ebp - 0x21c]
mov edx, 0x1c0
call fcn.004090da
test eax, eax
jns 0x4092a7
mov ebx, dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x402328
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x40927c
call fcn.00404e7f
mov edi, eax
test edi, edi
js 0x4092a9
mov esi, dword [ebx]
lea eax, [ebp - 0x218]
push 0
push 0x1c0
push eax
mov ecx, dword [esi + 0x50]
push 0
push ebx
call dword [0x410410]
call dword [esi + 0x50]
mov edi, eax
test edi, edi
js 0x4092a9
xor edi, edi
test edi, edi
js 0x4092a9
xor edi, edi
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x21c]
test ecx, ecx
je 0x4092c7
mov edx, dword [ecx]
push ecx
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x410410]
call esi
mov eax, edi
call fcn.0040d376
ret
Function at 0x40a463
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x40f314]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push ecx
push ecx
xor edi, edi
mov dword [esp + 0x1c], eax
push ecx
lea ecx, [esp + 0x24]
mov dword [eax], edi
mov dword [eax + 4], edi
call fcn.00409438
push 0x4028c4
lea ecx, [esp + 0x1c]
call fcn.00409822
lea eax, [esp + 0x18]
push eax
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x40a4de
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40a514
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xc8
call fcn.0040a1eb
mov edi, eax
jmp 0x40a514
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov ecx, esi
call fcn.0040a34c
mov ebx, eax
test ebx, ebx
jns 0x40a506
push ebx
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xce
call fcn.0040a1cc
mov edi, ebx
jmp 0x40a514
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
test esi, esi
je 0x40a51e
push esi
call fcn.0040a245
mov ecx, dword [esp + 0x224]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040c9b0
mov esp, ebp
pop ebp
ret 8

Function at 0x40b0f7
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, cl
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push esi
test cl, cl
je 0x40b144
xor esi, esi
push esi
push eax
push esi
push 3
push 1
push esi
push esi
push 0x402a00
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40b177
push 4
lea eax, [ebp - 8]
push eax
push 4
push esi
push 0x4028d8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40b16e
push eax
push 0xf003f
push 0
push 0x402928
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40b177
push 0x402ab8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40b17c
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.0040ae64
test al, al
lea eax, [ebp - 4]
je 0x40b1cb
xor esi, esi
push esi
push eax
push esi
push 3
push 1
push esi
push esi
push 0x402a00
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40b1fe
push 4
lea eax, [ebp - 8]
push eax
push 4
push esi
push 0x4028e8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40b1f5
push eax
push 0xf003f
push 0
push 0x402928
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40b1fe
push 0x402ab8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40c9a0
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x40e5c8
call fcn.0040cf18
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x40fd50
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x40c785
cmp eax, esi
jne 0x40c778
xor esi, esi
inc esi
mov edi, esi
jmp 0x40c788
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40c75c
xor esi, esi
inc esi
cmp dword [0x40fd54], esi
jne 0x40c79a
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x40c7d4
cmp dword [0x40fd54], ebx
jne 0x40c7ce
mov dword [0x40fd54], esi
push 0x401304
push 0x4012f8
call fcn.0040c904
pop ecx
pop ecx
test eax, eax
je 0x40c7d4
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40c8fe
mov dword [0x40f884], esi
cmp dword [0x40fd54], esi
jne 0x40c7f7
push 0x4012f4
push 0x4012cc
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x40fd54], 2
test edi, edi
jne 0x40c804
xor eax, eax
mov ecx, 0x40fd50
xchg dword [ecx], eax
cmp dword [0x40fd60], 0
je 0x40c830
push 0x40fd60
call fcn.0040cd70
pop ecx
test eax, eax
je 0x40c830
push ebx
push 2
push ebx
mov esi, dword [0x40fd60]
mov ecx, esi
call dword [0x410410]
call esi
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov ecx, dword [eax]
test ecx, ecx
je 0x40c7bd
mov dword [ebp - 0x20], ecx
push 0x20
pop esi
mov edx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp ax, si
ja 0x40c89b
test ax, ax
je 0x40c86a
test edx, edx
jne 0x40c89b
test ax, ax
je 0x40c86a
cmp ax, si
ja 0x40c86a
add ecx, 2
mov dword [ebp - 0x20], ecx
movzx eax, word [ecx]
jmp 0x40c855
test byte [ebp - 0x3c], 1
je 0x40c876
movzx eax, word [ebp - 0x38]
jmp 0x40c879
push 0xa
pop eax
push eax
push ecx
push ebx
push 0x400000
call main
mov dword [0x40f880], eax
cmp dword [0x40f898], 0
jne 0x40c8e3
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp eax, 0x22
jne 0x40c8ac
xor eax, eax
test edx, edx
sete al
mov edx, eax
mov dword [ebp - 0x1c], edx
add ecx, 2
mov dword [ebp - 0x20], ecx
jmp 0x40c844
cmp dword [0x40f884], 0
jne 0x40c8f7
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x40f880]
mov dword [ebp - 4], 0xfffffffe
call fcn.0040cf5d
ret
call fcn.0040ce65
jmp 0x40c733

Function at 0x40cc64
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x40e608
call fcn.0040cf18
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x40ccc4
cmp eax, 0xffffffff
je 0x40ccc4
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40ccbd
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40ccbd
cmp edx, 0x10000000
jae 0x40ccbd
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40ccba
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.0040cf5d
ret 4
Function at 0x40cd20
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40cd5e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x40cd56
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x40cd60
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x40cd46
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40ce30
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x40ce61
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40ce61
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x40ce61
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10001e80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
push 2
push 0
push 0x10001d20
mov ecx, dword [0x1006a248]
call fcn.100266e0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10001f8d
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
mov ecx, dword [0x10069828]
call fcn.10001440
push eax
push 0
lea eax, [ebp - 0x34]
push eax
push 0
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [0x1006982c]
call fcn.10011390
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10003040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 5
mov dword [ebp - 8], 0
jmp 0x10003062
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x33
jge 0x100030a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x779227d4]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000309c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10003059
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x33], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x100030c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 7
mov dword [ebp - 8], 0
jmp 0x100030e2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2b
jge 0x10003121
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x6fff3f68]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000311c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100030d9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x2b], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10003140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x16
mov dword [ebp - 8], 0
jmp 0x10003162
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2b
jge 0x100031a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x5d1e2afe]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000319c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10003159
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x2b], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x100038a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov dword [ebp - 0x2f4], ecx
mov dword [ebp - 0x2d0], 0
push 0x2c8
push 0
lea eax, [ebp - 0x2cc]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x2d0], 0x10010
lea ecx, [ebp - 0x2d0]
push ecx
push 0xfffffffffffffffe
mov edx, dword [0x10069824]
mov eax, dword [edx + 0x10]
call eax
test eax, eax
je 0x10003a1a
cmp dword [ebp - 0x2cc], 0
jne 0x10003926
cmp dword [ebp - 0x2c8], 0
jne 0x10003926
cmp dword [ebp - 0x2c4], 0
jne 0x10003926
cmp dword [ebp - 0x2c0], 0
jne 0x10003926
cmp dword [ebp - 0x2b8], 0
je 0x10003a1a
mov byte [ebp - 0x2f0], 0x48
mov byte [ebp - 0x2ef], 0x61
mov byte [ebp - 0x2ee], 0x72
mov byte [ebp - 0x2ed], 0x64
mov byte [ebp - 0x2ec], 0x77
mov byte [ebp - 0x2eb], 0x61
mov byte [ebp - 0x2ea], 0x72
mov byte [ebp - 0x2e9], 0x65
mov byte [ebp - 0x2e8], 0x20
mov byte [ebp - 0x2e7], 0x62
mov byte [ebp - 0x2e6], 0x72
mov byte [ebp - 0x2e5], 0x65
mov byte [ebp - 0x2e4], 0x61
mov byte [ebp - 0x2e3], 0x6b
mov byte [ebp - 0x2e2], 0x70
mov byte [ebp - 0x2e1], 0x6f
mov byte [ebp - 0x2e0], 0x69
mov byte [ebp - 0x2df], 0x6e
mov byte [ebp - 0x2de], 0x74
mov byte [ebp - 0x2dd], 0x20
mov byte [ebp - 0x2dc], 0x64
mov byte [ebp - 0x2db], 0x65
mov byte [ebp - 0x2da], 0x74
mov byte [ebp - 0x2d9], 0x65
mov byte [ebp - 0x2d8], 0x63
mov byte [ebp - 0x2d7], 0x74
mov byte [ebp - 0x2d6], 0x65
mov byte [ebp - 0x2d5], 0x64
mov byte [ebp - 0x2d4], 0
mov ecx, dword [0x10069828]
call fcn.10001440
push eax
push 0
lea ecx, [ebp - 0x2f0]
push ecx
push 1
lea edx, [ebp - 0x2f0]
push edx
mov ecx, dword [0x1006982c]
call fcn.10011390
mov esp, ebp
pop ebp
ret

Function at 0x10003a20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10069820]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movzx eax, word [edx]
cmp eax, 0x5a4d
je 0x10003a41
xor eax, eax
jmp 0x10003a83
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x4550
je 0x10003a5c
xor eax, eax
jmp 0x10003a83
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x28]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x28]
add ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
movzx eax, byte [edx]
xor ecx, ecx
cmp eax, 0xcc
sete cl
mov eax, ecx
mov esp, ebp
pop ebp
ret