joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d0d30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4d0d3b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x4d0e3e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x109c49c]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x109c49c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x109c49c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x109c49c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x109c49c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x109c49c]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x109c49c]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x109c49c]
xor eax, edx
inc ecx
dec edi
jne 0x4d0d56
pop edi
test esi, esi
je 0x4d0e60
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x109c49c]
xor eax, edx
inc ecx
dec esi
jne 0x4d0e42
pop esi
pop ebx
not eax
ret

Function at 0x4d16a0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
mov cl, byte [ebx]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x4d16e1
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x4d16d6
mov byte [ebx + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
push esi
push edi
lea esi, [edx + eax]
cmp esi, ecx
jbe 0x4d16f4
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x10]
mov edi, dword [esp + 0x14]
mov ecx, eax
add esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x18]
pop edi
add ecx, eax
pop esi
div ebp
mov dword [ebx + 0x18], ecx
pop ebp
pop ebx
ret
Function at 0x4d2630
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp], 0
jne 0x4d26e5
cmp dword [ebp + 4], 0xffffffff
jne 0x4d26e5
push ebx
lea ebx, [ebp + 0x138]
push ebx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
mov edi, 0x10c1140
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
pop ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
cmp esi, 1
jne 0x4d26ad
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileType]
cmp eax, 1
je 0x4d26ad
pop edi
pop esi
mov eax, 0x2000000
pop ebp
pop ecx
ret 0xc
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push esi
push ecx
push edi
call fcn.004d1430
add esp, 0x10
test eax, eax
jne 0x4d26d0
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
push eax
call fcn.004d1970
add esp, 4
mov dword [ebp], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 0x1000000
pop ebp
pop ecx
ret 0xc

Function at 0x4d2b40
Capabilities:
Create directory

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x208
test ecx, ecx
je 0x4d2c08
mov al, byte [ecx]
test al, al
je 0x4d2c08
push ebx
push esi
push edi
mov ebx, ecx
mov esi, ecx
cmp al, 0x2f
je 0x4d2b6b
cmp al, 0x5c
jne 0x4d2b6d
mov ebx, esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4d2b63
mov edi, dword [esp + 0x218]
cmp ebx, ecx
je 0x4d2ba4
mov esi, ebx
lea eax, [esp + 0xc]
sub esi, ecx
push esi
push ecx
push eax
call fcn.004eec35
lea ecx, [esp + 0x18]
mov byte [esp + esi + 0x18], 0
push ecx
push edi
call fcn.004d2b40
add esp, 0x14
inc ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x110]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x110]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x114]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
pop edi
pop esi
pop ebx
add esp, 0x208
ret
Function at 0x4d4110
Capabilities:
Parse pe header

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
cmp word [eax], 0x5a4d
push edi
je 0x4d4128
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov ebp, dword [eax + 0x3c]
add ebp, eax
cmp dword [ebp], 0x4550
je 0x4d413e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [ebp + 0x50]
mov ecx, dword [ebp + 0x34]
mov esi, dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
push 4
push 0x2000
push eax
push ecx
call esi
mov edi, eax
test edi, edi
mov dword [esp + 0x10], edi
jne 0x4d417f
mov edx, dword [ebp + 0x50]
push 4
push 0x2000
push edx
push eax
call esi
test eax, eax
mov dword [esp + 0x10], eax
jne 0x4d417b
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edi, dword [esp + 0x10]
push 0x14
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebx, eax
xor eax, eax
push 4
push 0x1000
mov dword [ebx + 4], edi
mov dword [ebx + 0xc], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0x50]
push eax
push edi
call esi
mov ecx, dword [ebp + 0x54]
push 4
push 0x1000
push ecx
push edi
call esi
mov esi, dword [esp + 0x18]
mov edi, dword [ebp + 0x54]
push ebx
push ebp
mov ecx, dword [esi + 0x3c]
add ecx, edi
mov edi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
push ecx
mov edx, dword [ecx + 0x3c]
add eax, edx
mov dword [ebx], eax
mov dword [eax + 0x34], esi
call fcn.004d4260
mov ecx, dword [ebp + 0x34]
mov eax, esi
add esp, 0xc
sub eax, ecx
je 0x4d4208
push eax
push ebx
call fcn.004d43f0
add esp, 8
push ebx
call fcn.004d4470
add esp, 4
test eax, eax
je 0x4d4240
push ebx
call fcn.004d4330
mov eax, dword [ebx]
add esp, 4
mov eax, dword [eax + 0x28]
test eax, eax
je 0x4d4258
add esi, eax
test esi, esi
je 0x4d4240
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call esi
test eax, eax
jne 0x4d4251
push ebx
call fcn.004d4620
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [ebx + 0x10], 1
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
pop ecx
ret
Function at 0x4d4260
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
xor ecx, ecx
mov ebp, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 8], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebx, [ecx + eax + 0x18]
jbe 0x4d4321
push esi
push edi
add ebx, 0x10
cmp dword [ebx], 0
jne 0x4d42cb
mov edx, dword [esp + 0x1c]
mov esi, dword [edx + 0x38]
test esi, esi
jle 0x4d42ff
mov eax, dword [ebx - 4]
push 4
push 0x1000
add eax, ebp
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov ecx, esi
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x4d42ff
mov ecx, dword [ebx - 4]
mov eax, dword [ebx]
push 4
push 0x1000
add ecx, ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, dword [esp + 0x18]
mov edx, ecx
add esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx - 8], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc eax
add ebx, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x4d428e
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4d4330
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
xor ecx, ecx
push ebp
mov ebx, dword [eax]
xor ebp, ebp
mov cx, word [ebx + 0x14]
cmp word [ebx + 6], bp
lea eax, [ecx + ebx + 0x18]
jbe 0x4d43e4
push esi
push edi
lea edi, [eax + 0x24]
mov eax, dword [edi]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x4d4387
mov edx, dword [edi - 0x14]
mov eax, dword [edi - 0x1c]
push 0x4000
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
jmp 0x4d43ca
lea ecx, [edx + ecx*2]
test eax, 0x4000000
lea edx, [esi + ecx*2]
mov edx, dword [edx*4 + 0x10c2e90]
je 0x4d439e
or dh, 2
mov ecx, dword [edi - 0x14]
test ecx, ecx
jne 0x4d43b7
test al, 0x40
je 0x4d43ae
mov ecx, dword [ebx + 0x20]
jmp 0x4d43b5
test al, 0x80
je 0x4d43ca
mov ecx, dword [ebx + 0x24]
test ecx, ecx
jbe 0x4d43ca
lea eax, [esp + 0x10]
push eax
push edx
push ecx
mov ecx, dword [edi - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov edx, dword [esp + 0x18]
xor eax, eax
inc ebp
add edi, 0x28
mov ebx, dword [edx]
mov ax, word [ebx + 6]
cmp ebp, eax
jl 0x4d4354
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4d7530
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x110725c]
xor edx, edx
cmp eax, edx
jne 0x4d7556
xor eax, eax
mov byte [eax + 0x110715c], al
inc eax
cmp eax, 0x100
jl 0x4d753e
mov dword [0x110725c], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x110715c
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4d75e7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4d75ba
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4d7588
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4d7660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4d76b3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4d769a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4de060
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50c24e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004de980
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x109cafc
call fcn.004fc76c
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4de0f3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004fc76c
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4de0ec
push 0
mov ecx, eax
call fcn.004d5160
mov dword [esi + 0xc], eax
jmp 0x4de0f5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4de0f5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4ee9fd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4eea1d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call fcn.004ed87a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4eea40
test byte [esp + 8], 2
je 0x4eea40
call fcn.004ed8ed
mov dword [eax], 0xd
call fcn.004ed8f6
mov dword [eax], 5
jmp 0x4eea19
xor eax, eax
ret

Function at 0x4fedfc
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4fee34
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004fce86
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004fce5e
jmp 0x4fee40
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5004ee
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x500530
call fcn.00506152
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, edi
je 0x500530
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, edi
jne 0x500527
xor eax, eax
jmp 0x500538
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0050053e
pop edi
pop esi
pop ebx
ret 4

Function at 0x506682
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5066b0
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x5066ce
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005065e8
jmp 0x5066ce
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5066ce
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005065e8
test edi, edi
mov eax, edi
jne 0x5066b8
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10003f28
Capabilities:
Send data
Send data on socket

Disassembly:
push 4
mov eax, 0x10006b1d
call fcn.1000674a
push 0x10
call fcn.100056da
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov ecx, eax
call fcn.1000244e
mov esi, eax
push 0xa8
mov ecx, esi
call fcn.10002476
push 1
call fcn.10002476
call fcn.100024c2
mov ecx, esi
call fcn.10005506
mov ecx, dword [esi + 0xc]
push 0
movzx eax, word [ecx]
add eax, 2
push eax
push ecx
push dword [0x1000955c]
call dword [sym.imp.WS2_32.dll_send]
push dword [esi + 0xc]
call fcn.100057f0
push 0x10
push esi
call fcn.1000570a
add esp, 0xc
call fcn.10006727
ret 8

Function at 0x10003f9e
Capabilities:
Send data
Send data on socket

Disassembly:
push 4
mov eax, 0x10006b1d
call fcn.1000674a
push 0x10
call fcn.100056da
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov ecx, eax
call fcn.1000244e
mov esi, eax
push 0x6e
mov ecx, esi
call fcn.10002476
movzx ecx, word [0x100094f8]
push ecx
mov ecx, esi
call fcn.1000249a
movzx ecx, word [0x100094fc]
push ecx
mov ecx, esi
call fcn.1000249a
movzx eax, word [0x10009540]
push eax
call fcn.1000249a
movzx eax, word [0x1000953c]
push eax
call fcn.1000249a
call fcn.100024c2
mov ecx, esi
call fcn.10005506
mov ecx, dword [esi + 0xc]
push 0
movzx eax, word [ecx]
add eax, 2
push eax
push ecx
push dword [0x1000955c]
call dword [sym.imp.WS2_32.dll_send]
push dword [esi + 0xc]
call fcn.100057f0
push 0x10
push esi
call fcn.1000570a
add esp, 0xc
call fcn.10006727
ret
Function at 0x1000433f
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push 0x144
mov eax, 0x10006b87
call fcn.1000677d
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x144]
push str.SOFTWARETibiazQt_DLL_Tibiantic
call fcn.10001aab
xor ebx, ebx
lea ecx, [ebp - 0x12c]
push str.remember
mov dword [ebp - 4], ebx
call fcn.10001aab
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 1
mov dword [ebp - 0x150], 0xff
mov dword [ebp - 0x14c], ebx
test eax, eax
jne 0x1000443a
cmp dword [ebp - 0x130], 0xf
lea eax, [ebp - 0x144]
jbe 0x100043aa
mov eax, dword [ebp - 0x144]
lea ecx, [ebp - 0x148]
push ecx
push 0x20019
push ebx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004534
cmp dword [ebp - 0x118], 0xf
lea eax, [ebp - 0x12c]
jbe 0x100043e0
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x150]
push ecx
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x14c]
push ecx
push ebx
push eax
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10004528
cmp dword [ebp - 0x14c], 1
jne 0x10004528
lea eax, [ebp - 0x114]
mov byte [0x1000951c], 1
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
pop ecx
push eax
lea eax, [ebp - 0x114]
push eax
jmp 0x1000451e
cmp eax, 1
jne 0x100044b5
cmp dword [ebp - 0x130], 0xf
lea eax, [ebp - 0x144]
jbe 0x10004454
mov eax, dword [ebp - 0x144]
push ebx
lea ecx, [ebp - 0x148]
push ecx
push ebx
push 0x20006
push ebx
push ebx
push ebx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10004534
cmp dword [ebp - 0x118], 0xf
lea edi, [ebp - 0x12c]
jbe 0x1000448e
mov edi, dword [ebp - 0x12c]
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
push esi
call ebx
pop ecx
inc eax
push eax
push esi
push 1
push 0
push edi
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x10004528
push esi
call ebx
jmp 0x1000451b
cmp eax, 2
jne 0x10004534
cmp dword [ebp - 0x130], 0xf
lea eax, [ebp - 0x144]
jbe 0x100044cf
mov eax, dword [ebp - 0x144]
lea ecx, [ebp - 0x148]
push ecx
push 2
push ebx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004534
cmp dword [ebp - 0x118], 0xf
lea eax, [ebp - 0x12c]
jbe 0x100044fe
mov eax, dword [ebp - 0x12c]
push eax
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x10004528
mov esi, 0x10007244
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
pop ecx
push eax
push esi
mov ecx, 0x10009520
call fcn.10001605
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x12c]
call fcn.1000154c
lea ecx, [ebp - 0x144]
call fcn.1000154c
call fcn.1000673b
ret 8
Function at 0x10004c2b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0x40
push dword [ebp + 8]
mov ebx, edx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [ebp + 8], 2
jne 0x10004c51
mov word [esi], bx
jmp 0x10004c59
cmp dword [ebp + 8], 1
jne 0x10004c59
mov byte [esi], bl
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebx
leave
ret

Function at 0x10004c6e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 8]
mov ebx, edx
push eax
mov esi, ecx
push 0x40
push ebx
mov dword [ebp - 4], esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
pop ecx
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy]
pop ecx
pop ecx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
pop ecx
push eax
push dword [ebp - 4]
call esi
pop esi
pop ebx
leave
ret

Function at 0x10005506
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x719d78]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [0x719d7c]
xor ebx, ebx
mov dword [ebp - 0x24], eax
mov eax, dword [0x719d80]
cmp dword [edi + 8], 2
mov esi, dword [edi]
sete bl
mov dword [ebp - 0x20], eax
mov eax, dword [0x719d84]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], eax
lea ebx, [ebx*4 + 2]
add esi, ebx
mov dword [ebp - 0x14], ebx
mov ecx, esi
mov dword [ebp - 8], esi
and ecx, 0x80000007
jns 0x1000555f
dec ecx
or ecx, 0xfffffff8
add ecx, 1
je 0x1000556b
push 8
pop eax
sub eax, ecx
add esi, eax
mov dword [ebp - 8], esi
mov ecx, dword [edi + 0xc]
mov eax, esi
cdq
add ecx, ebx
and edx, 3
mov dword [ebp - 0xc], ecx
add eax, edx
xor edx, edx
sar eax, 2
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edx
test eax, eax
jle 0x100055ff
mov edi, dword [ecx + edx*4]
xor esi, esi
mov ebx, dword [ecx + edx*4 + 4]
push 0x20
pop edx
mov ecx, ebx
mov eax, ebx
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, esi
and eax, 3
add ecx, ebx
mov eax, dword [ebp + eax*4 - 0x28]
add eax, esi
sub esi, 0x61c88647
xor ecx, eax
add edi, ecx
mov ecx, edi
mov eax, edi
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, esi
shr eax, 0xd
add ecx, edi
and eax, 3
mov eax, dword [ebp + eax*4 - 0x28]
add eax, esi
xor ecx, eax
add ebx, ecx
sub edx, 1
jne 0x10005596
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + edx*4], edi
mov dword [ecx + edx*4 + 4], ebx
add edx, 2
mov dword [ebp - 4], edx
cmp edx, dword [ebp - 0x10]
jl 0x1000558a
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
mov eax, dword [edi + 0xc]
lea ecx, [ebx - 2]
add ecx, esi
mov word [eax], cx
mov dword [edi], esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10005611
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x719d78]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x719d7c]
mov dword [ebp - 0x18], eax
mov eax, dword [0x719d80]
mov dword [ebp - 0x14], eax
mov eax, dword [0x719d84]
mov dword [ebp - 0x10], eax
mov eax, edx
cdq
and edx, 3
add eax, edx
xor edx, edx
sar eax, 2
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
push esi
mov esi, ecx
mov dword [ebp - 8], esi
test eax, eax
jle 0x100056c9
push ebx
push edi
mov edi, dword [esi + edx*4 + 2]
mov ebx, dword [esi + edx*4 + 6]
mov esi, 0xc6ef3720
push 0x20
pop edx
mov ecx, edi
mov eax, edi
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, esi
shr eax, 0xd
add ecx, edi
and eax, 3
mov eax, dword [ebp + eax*4 - 0x1c]
add eax, esi
add esi, 0x61c88647
xor ecx, eax
sub ebx, ecx
mov ecx, ebx
mov eax, ebx
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, esi
and eax, 3
add ecx, ebx
mov eax, dword [ebp + eax*4 - 0x1c]
add eax, esi
xor ecx, eax
sub edi, ecx
sub edx, 1
jne 0x10005666
mov edx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov dword [esi + edx*4 + 2], edi
mov dword [esi + edx*4 + 6], ebx
add edx, 2
mov dword [ebp - 4], edx
cmp edx, dword [ebp - 0xc]
jl 0x10005656
pop edi
pop ebx
pop esi
leave
ret