joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1200b5c5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x1201c373
call fcn.1201a4d8
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x10], ebx
push 2
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x14], esi
jne 0x1200b622
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
test eax, eax
jg 0x1200b60d
call esi
mov esi, eax
jmp 0x1200b73b
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1200b73b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov edi, eax
cmp edi, ebx
je 0x1200b643
push edi
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
mov esi, eax
cmp esi, ebx
jne 0x1200b66b
mov esi, dword [sym.imp.kernel32.dll_GetLastError]
call esi
test eax, eax
jg 0x1200b656
call esi
jmp 0x1200b730
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1200b732
push edi
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
cmp byte [ebx + esi], 0
mov edi, esi
je 0x1200b6da
lea edi, [ebx + 1]
cmp edi, 0x400
ja 0x1200b6a7
push edi
call fcn.12008405
test al, al
pop ecx
je 0x1200b6a7
mov eax, edi
add eax, 3
and eax, 0xfffffffc
call fcn.1201a440
mov dword [ebp + 8], esp
jmp 0x1200b6b3
push edi
lea ecx, [ebp - 0x10]
call fcn.1201b254
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x1200b6c1
mov esi, 0x8007000e
jmp 0x1200b732
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
mov byte [eax + ebx], 0
test edi, edi
jne 0x1200b6e2
xor eax, eax
jmp 0x1200b724
push edi
call dword [sym.imp.kernel32.dll_lstrlenA]
mov esi, eax
inc esi
lea ebx, [esi + esi]
cmp ebx, 0x400
ja 0x1200b713
push ebx
call fcn.12008405
test al, al
pop ecx
je 0x1200b713
mov eax, ebx
add eax, 3
and eax, 0xfffffffc
call fcn.1201a440
mov eax, esp
jmp 0x1200b71c
push ebx
lea ecx, [ebp - 0x10]
call fcn.1201b254
push esi
push edi
push eax
call fcn.1201b254
push dword [ebp + 0x14]
lea ecx, [ebp - 0x1c]
push eax
call fcn.1201b254
mov esi, eax
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea ecx, [ebp - 0x10]
call fcn.12008e8b
mov eax, esi
lea esp, [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1201a428
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [section..cdata]
push edi
mov dword [ebp + 0x2a4], eax
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x80], 0xc0000409
lea eax, [ebp + 0x2ac]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0x2ac]
mov dword [ebp - 0x28], 0x10001
mov eax, dword [eax]
mov dword [ebp + 0x90], eax
lea eax, [ebp + 0x2ac]
mov dword [ebp + 0x9c], eax
push ss
pop dword [ebp + 0xa0]
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x2c], eax
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
push 0x502
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.1201a428
pop edi
add ebp, 0x2a8
leave
ret
cmp ecx, dword [section..cdata]
jne 0x1201a431
ret
jmp 0x1201a2f6

Function at 0x1201b100
Capabilities:
Get thread local storage value

Disassembly:
push dword [0x12020684]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax + 0xc]
ret

Function at 0x1201b254
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1201b263
pop dword [ebp - 8]
mov eax, 0x1201b263
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x374a5
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x3283
mov edx, eax
mov edi, 0x99d565a2
add edi, 0x782fea5e
add edi, dword [ebp - 8]
mov esi, 0x23a88e8d
add dword [ebp - 4], edi
mov ebx, dword [edi]
sub dword [ebp - 4], edx
xor ebx, esi
mov dword [ebp - 4], 0x74bfbf0f
mov dword [edx], ebx
xor dword [ebp - 4], esi
add edx, 0x3d3b7cb2
add edx, 0xc2c48352
add edi, 4
loop 0x1201b2ac
add eax, 0x90baa007
sub eax, 0x90b9e328
mov ebx, eax
add eax, 5
mov ecx, 0x12000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x1011f9b
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x10015a0
call fcn.0101219c
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1011fd6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1011fd6
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1011fee
cmp eax, 0x20b
je 0x1011fdb
mov dword [ebp - 0x1c], edi
jmp 0x1012002
cmp dword [ecx + 0x84], 0xe
jbe 0x1011fd6
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1011ffc
cmp dword [ecx + 0x74], 0xe
jbe 0x1011fd6
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1013064], 0xffffffff
or dword [0x1013068], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x101305c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1013058]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x101306c], eax
call fcn.01012194
cmp dword [0x1013030], edi
jne 0x101205d
push fcn.01012194
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0101217d
push 0x1013010
push 0x101300c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1013054]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1013050]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x34], eax
push 0x1013008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___winitenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.0100b5c9
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x10120d4
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1012109
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.010121d7
ret

Function at 0x100010e3
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push dword [ebp + 8]
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov dword [ebp - 4], eax
or eax, eax
je 0x10001115
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x10001115
push dword [ebp - 4]
call fcn.100010c6
push 0
pop dword [ebp - 4]
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x10001134
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push 0x44
lea eax, [ebp - 0x44]
push eax
call fcn.1000111c
push 0x10
lea eax, [ebp - 0x54]
push eax
call fcn.1000111c
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call sub.kernel32.dll_CreateProcessA
lea edi, [ebp - 0x54]
push dword [edi]
push dword [edi + 4]
call sub.kernel32.dll_CloseHandle
call sub.kernel32.dll_CloseHandle
leave
ret 4
Function at 0x10078df
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x100e4e0
call fcn.01007c54
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10104ec
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x10076f4
cmp eax, esi
jne 0x10076e7
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x10076f7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10076ce
xor esi, esi
inc esi
mov eax, dword [0x10104e8]
cmp eax, esi
jne 0x100770a
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1007745
mov eax, dword [0x10104e8]
test eax, eax
jne 0x100773f
mov dword [0x10104e8], esi
push 0x10012c8
push 0x10012bc
call fcn.0100764b
pop ecx
pop ecx
test eax, eax
je 0x1007745
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x100780f
mov dword [0x1010090], esi
mov eax, dword [0x10104e8]
cmp eax, esi
jne 0x1007769
push 0x10012b8
push 0x10012b0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10104e8], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1007776
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10104f0], ebx
je 0x1007797
push 0x10104f0
call fcn.01007bc9
pop ecx
test eax, eax
je 0x1007797
push ebx
push 2
push ebx
call dword [0x10104f0]
push dword [0x1010078]
push dword [0x101007c]
push dword [0x1010074]
call fcn.01005cbb
add esp, 0xc
mov dword [0x101008c], eax
cmp dword [0x1010080], ebx
jne 0x10077f5
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1010090], ebx
jne 0x1007803
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x101008c]
call fcn.01007c99
ret
call fcn.01007da1
jmp 0x10076ac
Function at 0x100a22d
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa08
mov eax, dword [0x101003c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor esi, esi
mov dword [ebp - 0x9e4], eax
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0xa04]
mov dword [ebp - 0xa08], esi
mov dword [ebp - 0x9e8], edx
mov dword [ebp - 0x9e0], esi
mov dword [ebp - 0x9dc], esi
rep stosd dword es:[edi], eax
mov word [ebp - 0x46], ax
cmp dword [ebp - 0x9e4], esi
je 0x100a3b1
cmp ebx, esi
je 0x100a3b1
mov eax, dword [ebx]
cmp eax, esi
je 0x100a2aa
cmp eax, 2
jb 0x100a3b1
cmp edx, esi
je 0x100a3b1
cmp dword [0x10103cc], esi
jne 0x100a2de
lea eax, [ebp - 0x9d8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x100a2d4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
jmp 0x100a3bd
mov dword [0x10103cc], 1
lea eax, [ebp - 0x9dc]
push eax
lea eax, [ebp - 0xa08]
push eax
push esi
push dword [ebp - 0x9e4]
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
test eax, eax
jne 0x100a3c3
mov esi, dword [ebp - 0x9dc]
xor edi, edi
jmp 0x100a34b
push 4
xor eax, eax
mov word [ebp - 0x848], ax
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0x401
lea eax, [ebp - 0x848]
push eax
push dword [esi + 0x10]
push dword [esi + 0x18]
call dword [sym.imp.WS2_32.dll_GetNameInfoW]
cmp eax, edi
je 0x100a351
cmp eax, 0x2afc
jne 0x100a348
cmp word [ebp - 0x848], di
jne 0x100a351
mov esi, dword [esi + 0x1c]
cmp esi, edi
jne 0x100a30b
jmp 0x100a39d
lea esi, [ebp - 0x848]
cmp dword [ebp + 0x14], edi
jne 0x100a36e
mov eax, esi
push 0x10017c8
push eax
call dword [sym.imp.msvcrt.dll_wcstok]
pop ecx
pop ecx
mov esi, eax
push edi
push esi
call fcn.01008332
mov ecx, dword [ebx]
inc eax
cmp ecx, eax
jae 0x100a38a
mov dword [ebx], eax
mov dword [ebp - 0x9e0], 1
jmp 0x100a39d
push ecx
push esi
push dword [ebp - 0x9e8]
call fcn.01008ca4
mov dword [ebp - 0x9e0], eax
push dword [ebp - 0x9dc]
call dword [sym.imp.WS2_32.dll_FreeAddrInfoW]
mov eax, dword [ebp - 0x9e0]
jmp 0x100a3c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100a3c3
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010078f9
leave
ret 0x10
Function at 0x100a7df
Capabilities:
Connect network resource

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x100a93a
push esi
call fcn.0100a5a6
cmp eax, 1
je 0x100a93a
push esi
mov dword [ebp + 8], esi
call fcn.0100a134
cmp eax, 1
jne 0x100a819
add esi, 4
mov dword [ebp + 8], esi
push dword [ebp + 8]
call fcn.0100a70d
test eax, eax
jne 0x100a835
call fcn.01008103
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100a96e
cmp dword [ebp + 0x14], ebx
je 0x100a85e
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x100a85e
push dword [ebp + 0x14]
push dword [ebp + 8]
push 0x10018b8
push 2
call fcn.010094ef
add esp, 0x10
jmp 0x100a870
push dword [ebp + 8]
push 0x100189c
push 1
call fcn.010094ef
add esp, 0xc
test eax, eax
jne 0x100a893
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100a886
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.01008103
push 8
pop eax
jmp 0x100a96e
call fcn.01008070
cmp eax, ebx
jne 0x100a8a5
push 0x12
call fcn.01007fff
jmp 0x100a8af
push ebx
push ebx
push eax
push 0x12
call fcn.010091fe
mov edx, eax
cmp edx, ebx
je 0x100a874
push edi
push 8
pop ecx
push ebx
push dword [ebp + 0xc]
xor eax, eax
push dword [ebp + 0x10]
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], edx
call sub.MPR.dll_WNetAddConnection2W
mov esi, eax
pop edi
cmp esi, ebx
je 0x100a900
cmp esi, 0x4b8
je 0x100a8f9
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.01008103
jmp 0x100a968
call fcn.01009581
jmp 0x100a968
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 8]
call fcn.0100a3db
push eax
call fcn.0100824b
test eax, eax
jne 0x100a968
push dword [ebp + 8]
call fcn.0100a7c2
push 0x1580
call fcn.0100a082
push eax
call fcn.0100809c
mov esi, 0x4b8
jmp 0x100a968
cmp dword [ebp + 0xc], ebx
je 0x100a96c
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x100a96c
push 0x157e
call fcn.0100a082
push eax
call fcn.0100809c
mov esi, 0xa0010001
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x100a96e
xor eax, eax
pop esi
pop ebx
leave
ret 0x10
Function at 0x40ce94
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0040cf17
jae 0x40cea2
xor ecx, ecx
call fcn.0040cf17
jae 0x40ced1
xor eax, eax
call fcn.0040cf17
jae 0x40cee1
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0040cf17
adc al, al
jae 0x40cec3
jne 0x40cf0d
stosb byte es:[edi], al
jmp 0x40cea5
call fcn.0040cf23
sub ecx, ebx
jne 0x40ceea
call fcn.0040cf21
jmp 0x40cf09
lodsb al, byte [esi]
shr eax, 1
je 0x40cf33
adc ecx, ecx
jmp 0x40cf06
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.0040cf21
cmp eax, 0x7d00
jae 0x40cf06
cmp ah, 5
jae 0x40cf07
cmp eax, 0x7f
ja 0x40cf08
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x40cea5
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x40d260
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov esi, dword [ebx]
mov eax, dword [eax]
mov edx, dword [edx + 4]
mov dword [ebp - 4], esi
mov esi, dword [ebx + 4]
mov dword [ebp - 8], esi
mov esi, dword [ebx + 8]
mov dword [ebp - 0xc], esi
mov ebx, dword [ebx + 0xc]
mov dword [ebp - 0x10], ebx
mov ebx, 0x20
jmp 0x40d2cf
add ecx, 0x9e3779b9
mov esi, edx
shl esi, 4
add esi, dword [ebp - 4]
lea edi, [ecx + edx]
xor esi, edi
mov edi, edx
shr edi, 5
add edi, dword [ebp - 8]
xor esi, edi
add eax, esi
mov esi, eax
shl esi, 4
add esi, dword [ebp - 0xc]
lea edi, [ecx + eax]
xor esi, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp - 0x10]
xor esi, edi
add edx, esi
mov esi, ebx
add ebx, 0xffffffff
test esi, esi
jg 0x40d297
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40dbd0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor eax, eax
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
lea edx, [ebp - 0xc]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x114]
push ecx
push esi
push edi
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x40dc6f
mov dword [ebp - 0xc], 0xc8
push str.HIDVid_3689Pid_8762
call fcn.00405ae4
pop ecx
push eax
lea eax, [ebp - 0x110]
push eax
push 0x452cb2
call fcn.00405c5c
add esp, 0xc
test eax, eax
jne 0x40dc6f
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0xc]
jne 0x40dc6c
mov ecx, dword [ebp + 0x10]
mov esi, str.__
mov edi, ecx
lea edx, [ebp - 0x110]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00405aa8
add esp, 8
mov eax, 1
jmp 0x40dc7a
inc dword [ebp - 0x10]
inc esi
test ebx, ebx
je 0x40dbef
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x403e59
pop dword [ebp - 0x44]
mov eax, 0xff15ee39
sub eax, 0xfed5afe0
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x8ed3568f
add dword [ebp - 0x54], 0xbf7eeebc
mov dword [ebp - 0x50], 0x94927d45
sub dword [ebp - 0x50], 0x625f3100
mov dword [ebp - 0x4c], 0xcb753fd
add dword [ebp - 0x4c], 0x3f94f031
mov dword [ebp - 0x48], 0x5b4ecc8b
sub dword [ebp - 0x48], 0x5b4ecc8b
lea eax, [ebp - 0x54]
push eax
mov eax, 0x7487b71b
sub eax, 0x744746b7
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x776b530a
add dword [ebp - 0x54], 0xfd07164c
mov dword [ebp - 0x50], 0xefb29ec7
sub dword [ebp - 0x50], 0xae463d52
mov dword [ebp - 0x4c], 0x31e8c0e4
add dword [ebp - 0x4c], 0x3186ab88
mov dword [ebp - 0x48], 0xc1a0397a
add dword [ebp - 0x48], 0x3e5fc686
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xe7d5bed
add eax, 0xf1c314bb
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x396cd
push 0
call eax
mov ecx, 0x52b6
mov edx, eax
mov ebx, 0x512cac51
add ebx, 0xaf1453af
add ebx, dword [ebp - 0x44]
mov esi, 0xce1b5c37
add esi, 0xfa197959
sub dword [ebp - 0x38], ecx
mov edi, dword [ebx]
add dword [ebp - 0x1c], 0xd48444c
xor edi, esi
sub dword [ebp - 0x18], esi
mov dword [edx], edi
sub dword [ebp - 0x24], edi
add edx, 4
add ebx, 0xd24f913c
add ebx, 0x2db06ec8
loop 0x403f75
add eax, 0xfd769775
sub eax, 0xfd7559ca
mov ebx, eax
add eax, 0x9e063466
sub eax, 0x9e063461
mov ecx, 0x3f14c298
sub ecx, 0x3ed4c298
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x100391a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100391af
pop dword [ebp - 0x10]
mov eax, 0x40e60494
add eax, 0xcf1d8d1b
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x95473c5a
add dword [ebp - 0x20], 0xb90b08f1
mov dword [ebp - 0x1c], 0x1c3688fd
sub dword [ebp - 0x1c], 0xea033cb8
mov dword [ebp - 0x18], 0x604c157a
sub dword [ebp - 0x18], 0x13ffd14c
mov dword [ebp - 0x14], 0xfef0e968
sub dword [ebp - 0x14], 0xfef0e968
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xaf607694
sub dword [ebp - 0x20], 0x3aee0d3e
mov dword [ebp - 0x1c], 0x9f672c4d
sub dword [ebp - 0x1c], 0x5dfacad8
mov dword [ebp - 0x18], 0x3f1d3510
sub dword [ebp - 0x18], 0xdbadc8a4
mov dword [ebp - 0x14], 0xfb7da036
add dword [ebp - 0x14], 0x4825fca
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x46298
push 0
call eax
mov ecx, 0x3e38
xor ebx, ebx
add ebx, eax
mov esi, 0x10171e00
add esi, dword [ebp - 0x10]
mov edi, 0x9adff207
sub edi, 0x594235a4
add dword [ebp - 4], eax
mov edx, dword [esi]
sub dword [ebp - 8], ebx
xor edx, edi
mov dword [ebp - 0xc], 0x653a0db8
mov dword [ebx], edx
add dword [ebp - 4], 0xd2064168
add ebx, 0xacbbb51f
add ebx, 0x53444ae5
add esi, 0x517b16f0
sub esi, 0x517b16ec
loop 0x100392bd
add eax, 0x4163969d
add eax, 0xbe9d5516
mov ebx, eax
add eax, 5
mov ecx, 0xe079bd6b
sub ecx, 0xd079bd6b
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x10002a20
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x10021040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
mov esi, edx
mov dword [ebp - 0x238], ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x10002aff
push 0x228
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x230], 0x22c
push 0
push eax
call fcn.100073f0
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
je 0x10002af8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
nop word [eax + eax]
push dword [ebp - 0x238]
lea eax, [ebp - 0x20c]
push eax
call fcn.10008fa1
add esp, 8
test eax, eax
jne 0x10002ade
mov ecx, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x10002acf
mov eax, dword [ebp - 0x228]
mov dword [ecx], eax
add dword [esi + 4], 4
jmp 0x10002ade
lea eax, [ebp - 0x228]
push eax
push ecx
mov ecx, esi
call fcn.10005280
lea eax, [ebp - 0x230]
push eax
push edi
call ebx
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jne 0x10002aa0
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000559c
mov esp, ebp
pop ebp
ret

Function at 0x10002c70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10017bfd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10021040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.10002a20
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
cmp esi, ebx
je 0x10002d04
push dword [esi]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10002cfa
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 4
cmp esi, ebx
jne 0x10002cd8
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x10002d34
mov ecx, dword [ebp - 0x14]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x10002d2a
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002d50
push ecx
push esi
call fcn.100058f9
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000559c
mov esp, ebp
pop ebp
ret
call fcn.1000b2bd
int3