joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10049bec
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x10086038]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
push esi
push edi
mov dword [ebp - 0x80], eax
xor edi, edi
xor eax, eax
mov esi, 0x100
mov byte [ebp + eax + 0x90], al
inc eax
cmp eax, esi
jb 0x10049c1c
xor eax, eax
xor ecx, ecx
cmp eax, 0x31
jne 0x10049c33
xor eax, eax
mov dl, byte [eax + str._hardwareidentifier_pci_ven__s_hardwareidentifier_]
inc eax
mov byte [ebp + ecx - 0x74], dl
inc ecx
cmp ecx, esi
jb 0x10049c2c
mov dword [ebp - 0x78], edi
mov eax, 0xff
movsx esi, byte [ebp + edi - 0x74]
add esi, dword [ebp - 0x78]
lea ecx, [ebp + edi + 0x90]
mov dl, byte [ecx]
movsx ebx, dl
add ebx, esi
and ebx, eax
mov esi, ebx
mov dword [ebp - 0x78], esi
lea esi, [ebp + esi + 0x90]
mov bl, byte [esi]
inc edi
mov byte [ecx], bl
mov byte [esi], dl
cmp edi, 0x100
jb 0x10049c4b
xor edi, edi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
cmp dword [ebp + 0x1a4], edi
jbe 0x10049cd9
inc edi
and edi, eax
lea ecx, [ebp + edi + 0x90]
mov dl, byte [ecx]
movsx esi, dl
add esi, dword [ebp - 0x78]
and esi, eax
mov dword [ebp - 0x78], esi
lea esi, [ebp + esi + 0x90]
mov bl, byte [esi]
mov byte [ecx], bl
mov ebx, dword [ebp - 0x80]
mov byte [esi], dl
movsx ecx, byte [ecx]
mov esi, dword [ebp - 0x7c]
movsx edx, dl
add ecx, edx
and ecx, eax
mov cl, byte [ebp + ecx + 0x90]
add ebx, esi
xor byte [ebx], cl
inc esi
mov dword [ebp - 0x7c], esi
cmp esi, dword [ebp + 0x1a4]
jb 0x10049c8e
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10050724
add ebp, 0x198
leave
ret 8

Function at 0x1004a89f
Capabilities:
Hash data with md5

Disassembly:
push 0x40
lea eax, [esi + 4]
push 0
push eax
mov dword [esi], vtable.CMD5Checksum.0
call sub.MSVCR90.dll_memset
and dword [esi + 0x48], 0
and dword [esi + 0x44], 0
add esp, 0xc
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
mov eax, esi
ret
Function at 0x1004d418
Capabilities:
Get common file path
Shutdown system

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x10086038]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x24
mov eax, 0x10055007
call fcn.100514bc
lea eax, [ebp - 0x18]
push eax
push 0x28
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1004d55c
lea eax, [ebp - 0x20]
push eax
push str.SeShutdownPrivilege
xor ebx, ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
cmp eax, ebx
je 0x1004d55c
mov eax, dword [ebp - 0x20]
push ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
push ebx
push ebx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x30]
push eax
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x24], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1004d55c
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::Empty]
push 0x104
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_3]
push str.winsxspending.xml
lea ecx, [ebp - 0x14]
call dword [0x10061e44]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call sym.PCBRhelper.dll_Ordinal_981
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea eax, [ebp - 0x10]
push eax
call sym.PCBRhelper.dll_Ordinal_326
pop ecx
test eax, eax
je 0x1004d52c
call sym.PCBRhelper.dll_Ordinal_1176
cmp eax, 5
jbe 0x1004d52c
push 0x12
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x1004d553
xor eax, eax
cmp byte [esi + 0x3d8], bl
push 0x10
setne al
inc eax
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
call fcn.10010071
push ebx
push ebx
push 0x10
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10050724
add ebp, 0x20c
leave
ret
Function at 0x1004e6d8
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x10086038]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
push esi
mov esi, ecx
push edi
push esi
mov ecx, 0x1008a51c
mov dword [0x1008a518], 0x1000
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_3]
mov eax, esi
push 2
lea edx, [eax + 2]
pop edi
xor ebx, ebx
mov cx, word [eax]
add eax, edi
cmp cx, bx
jne 0x1004e6fc
sub eax, edx
sar eax, 1
cmp eax, 3
jbe 0x1004e781
cmp word [esi + 2], 0x3a
je 0x1004e781
push 0x104
lea eax, [ebp - 0x7c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x7c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, edi
cmp cx, bx
jne 0x1004e72c
sub eax, edx
sar eax, 1
lea ecx, [ebp + eax*2 - 0x7e]
je 0x1004e74d
sub ecx, edi
dec eax
cmp word [ecx], 0x5c
je 0x1004e753
cmp eax, ebx
jne 0x1004e740
cmp word [ecx], 0x5c
jne 0x1004e76a
lea edx, [ecx + 2]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, edi
cmp cx, bx
jne 0x1004e75a
jmp 0x1004e796
lea edx, [ebp - 0x7c]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, edi
cmp cx, bx
jne 0x1004e771
jmp 0x1004e796
lea edx, [ebp - 0x7c]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, edi
cmp cx, bx
jne 0x1004e788
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1004e7b9
push ecx
lea eax, [ebp - 0x7c]
mov ecx, esp
mov dword [ebp - 0x80], esp
push eax
call dword [0x10061e44]
call fcn.1004e8ab
push ebx
push 0x8b041
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [0x1008a504]
mov esi, 0x1008a504
mov ecx, esi
call dword [eax + 0x28]
test eax, eax
je 0x1004e7ec
mov eax, dword [0x1008a504]
push edi
push ebx
push ebx
mov ecx, esi
mov byte [0x1008a514], 1
call dword [eax + 0x30]
jmp 0x1004e7f2
mov byte [0x1008a514], bl
push 0x1008a4e8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [ebp + 0x190]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10050724
add ebp, 0x194
leave
ret
Function at 0x1004eced
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
push edi
mov esi, ecx
push dword [esi + 0xc]
mov dword [esi + 0x10], edi
push 0xa
push str.ncacn_np
call dword [sym.imp.RPCRT4.dll_RpcServerUseProtseqEpW]
test eax, eax
je 0x1004ed1a
mov dword [esi + 0x10], 4
xor eax, eax
jmp 0x1004ed5a
push sym.PCBRhelper.dll_Ordinal_298
push 0x4d2
push 0x10
push edi
push edi
push dword [esi + 8]
call dword [sym.imp.RPCRT4.dll_RpcServerRegisterIfEx]
test eax, eax
jne 0x1004ed0f
lea eax, [ebp - 4]
push eax
push edi
push edi
push sym.PCBRhelper.dll_Ordinal_962
push edi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
cmp eax, edi
je 0x1004ed0f
mov eax, dword [ebp + 8]
mov dword [esi], eax
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 4

Function at 0x1004ed60
Capabilities:
Listen for remote procedure calls

Disassembly:
push 0
push 0x4d2
push 1
call dword [sym.imp.RPCRT4.dll_RpcServerListen]
ret 4
Function at 0x10050724
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10086038]
jne 0x1005072e
repz ret
jmp fcn.10050d8c

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10005a7a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10005a89
pop dword [ebp - 0x28]
mov eax, 0x6ed8c5bb
add eax, 0xa12794ce
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x9a837662
add dword [ebp - 0x38], 0xb3cecee9
mov dword [ebp - 0x34], 0x8554d5ab
sub dword [ebp - 0x34], 0x53218966
mov dword [ebp - 0x30], 0xcb24af09
sub dword [ebp - 0x30], 0x7ed86adb
mov dword [ebp - 0x2c], 0xcdc6109e
add dword [ebp - 0x2c], 0x3239ef62
lea eax, [ebp - 0x38]
push eax
mov eax, 0xa667254d
sub eax, 0x96666529
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x8b31a2bc
add dword [ebp - 0x38], 0xe940c69a
mov dword [ebp - 0x34], 0x60ce8e20
sub dword [ebp - 0x34], 0x1f622cab
mov dword [ebp - 0x30], 0x5a54c159
add dword [ebp - 0x30], 0x91aab13
mov dword [ebp - 0x2c], 0x823dca7
add dword [ebp - 0x2c], 0xf7dc2359
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xc61bb887
add eax, 0x49e507a5
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3946e
push 0
call eax
mov ecx, 0xe8c4dcbf
sub ecx, 0xe8c48fb0
mov edi, eax
mov ebx, 0xc3a2259d
add ebx, 0x4c624e63
add ebx, dword [ebp - 0x28]
mov edx, 0x903c1229
add edx, 0xc53a06c6
mov dword [ebp - 0x18], 0x7dd84dd3
mov esi, dword [ebx]
add dword [ebp - 0x1c], ebx
xor esi, edx
sub dword [ebp - 0x1c], 0xb9470a4c
mov dword [edi], esi
add dword [ebp - 0x10], 0xa572345b
add edi, 4
add ebx, 0xd92599
add ebx, 0xff26da6b
loop 0x10005bab
add eax, 0x69c71e9e
sub eax, 0x69c5f78f
mov ebx, eax
add eax, 0xc39d5479
add eax, 0x3c62ab8c
mov ecx, 0x1e165360
sub ecx, 0xe165360
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x401c66
pop dword [ebp - 0x44]
mov eax, 0xfbdd5e97
sub eax, 0xfb9d4231
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xb279344d
sub dword [ebp - 0x54], 0x6426ef02
mov dword [ebp - 0x50], 0xca0bf500
add dword [ebp - 0x50], 0x68275745
mov dword [ebp - 0x4c], 0x93fe9e6e
add dword [ebp - 0x4c], 0xb84da5c0
mov dword [ebp - 0x48], 0x58a11f91
sub dword [ebp - 0x48], 0x58a11f91
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xcf671c63
add dword [ebp - 0x54], 0xa50b4cf3
mov dword [ebp - 0x50], 0x1e39540b
sub dword [ebp - 0x50], 0xdcccf296
mov dword [ebp - 0x4c], 0x9e6ca1ba
sub dword [ebp - 0x4c], 0x3afd354e
mov dword [ebp - 0x48], 0x7cb1df3d
add dword [ebp - 0x48], 0x834e20c3
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x341c2
push 0
call eax
mov ecx, SetFileAttributesW
xor edx, edx
add edx, eax
mov ebx, 0x407000
add ebx, dword [ebp - 0x44]
mov edi, 0xa451a74a
sub edi, 0xd8fbc4a4
xor dword [ebp - 0x18], 0x30f31c8e
mov esi, dword [ebx]
xor dword [ebp - 0x18], 0xb8b596f3
add esi, edi
add dword [ebp - 0x24], esi
mov dword [edx], esi
mov dword [ebp - 0x28], 0x20dc292
add edx, 0x1a95d036
sub edx, 0x1a95d032
add ebx, 0x44449b97
add ebx, 0xbbbb646d
loop 0x401d74
add eax, 0xece3
mov ebx, eax
add eax, 0xbebe5ddf
sub eax, 0xbebe5dda
mov ecx, 0x129ede06
sub ecx, 0x125ede06
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x100188ad
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop esp
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.10017409
xchg edx, eax
movsb byte es:[edi], byte [esi]
retf 0x8d92
Function at 0x1003a8fb
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
test dl, dl
je 0x1003a9b5
cmp byte [ebp + 0x10], 0
je 0x1003a921
mov eax, dword [ebp + 0x18]
inc dword [eax]
jmp 0x1003a9fa
mov dword [esp + 0xc], 0x3144
cmp dword [esp + 0xc], 0x349f
jle 0x1003a981
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [esp + 0x10]
cdq
push edx
push eax
call fcn.10002b5c
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003a95b
mov eax, dword [eax]
push eax
call fcn.1004d49f
pop ecx
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.10016e75
inc edi
cmp edi, 0x5acc
jl 0x1003a93f
inc esi
cmp esi, 0x2984
jl 0x1003a93d
cmp dword [esp + 0xc], 0x2f47
jge 0x1003a996
push str.miyh_qlwgsrj_uhl_bmyfcwy
call fcn.1004d49f
pop ecx
mov edx, dword [ebp + 0x20]
mov dword [edx], 0
jmp 0x1003a9ae
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 0x98a5
inc dword [edx]
cmp dword [edx], 1
jl 0x1003a9a1
jmp 0x1003a9fa
cmp byte [ebp + 8], 0
je 0x1003a9d7
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x1003a9fa
push 0
push 0x1e2e
push 0x1fdd
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x1003a9fa
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1003a9fa
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 4
inc dword [edx]
cmp dword [edx], 3
jl 0x1003a9e8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100400fe
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x100655b8
call fcn.10063d00
sub esp, 0x14
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], esi
je 0x100401c0
mov dword [ebp - 0x18], 0x47ef
cmp dword [ebp - 0x18], 0x4b1b
jle 0x10040171
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor edi, edi
xor esi, esi
mov dword [ebp - 0x14], esi
mov ebx, esi
mov esi, 0x59b7
mov eax, ebx
mov ecx, 0x10080b98
or eax, edi
cdq
push edx
push eax
call fcn.100165ff
dec ebx
dec esi
jne 0x10040144
mov esi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x769
jl 0x1004013d
inc edi
cmp edi, 0xc16
jl 0x10040138
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x4447
jge 0x1004018d
mov edx, str.jzeynt_rjhftyj_wncfh_czfjjl_mnwj_lahicmyu_etcqlmvn_cwek_bzzjp_zkmiurqm
mov ecx, 0x10080b98
call fcn.1001abd0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x14], 0x19b3
cmp dword [ebp - 0x14], 0x1d65
jle 0x10040217
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
and dword [ebp - 0x1c], 0
mov esi, ebx
and esi, edi
mov edi, dword [ebp - 0x1c]
mov eax, esi
mov ecx, 0x10080b98
or eax, edi
cdq
push edx
push eax
call fcn.100165ff
inc edi
cmp edi, 0x7b55
jl 0x100401e2
mov edi, dword [ebp - 0x18]
inc ebx
cmp ebx, 0x5ca2
jl 0x100401d7
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x1ba6
jl 0x100401d5
mov esi, dword [ebp - 0x20]
push 2
pop edi
mov dword [esi], 0
cmp dword [esi], edi
jge 0x10040238
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x1928
inc dword [esi]
cmp dword [esi], edi
jl 0x10040227
mov dword [ebp - 4], edi
cmp dword [ebp - 0x14], 0x18ce
jge 0x10040195
mov edx, str.snva_sws_cumxt_mqfsba
mov ecx, 0x10080b98
call fcn.1001abd0
jmp 0x10040195
Function at 0x100471a1
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x100471b8
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x100471da
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10338bd4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10338f60
jl 0x100471e8
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10339204
jl 0x10047228
mov ecx, dword [0x10339f50]
xor ecx, dword [0x10338bd4]
and ecx, edi
xor ecx, dword [0x10339f50]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10338bd0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10339204]
mov dword [0x10339590], eax
pop esi
ret
Function at 0x430003
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x4e174084
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x18063236
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x6d841c2a
Capabilities:
Check mutex on windows

Disassembly:
push 0x428
push 0x6d85a6b0
call fcn.6d84a590
xor ebx, ebx
cmp dword [0x6d85ea68], ebx
jne 0x6d841d87
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x328], bl
mov esi, dword [sym.imp.kernel32.dll_GetCurrentProcessId]
call esi
push eax
push str.java_plug_in_multi_versioning_mutex:ver1.1_d
lea eax, [ebp - 0x328]
push eax
call fcn.6d854575
add esp, 0xc
lea eax, [ebp - 0x328]
push eax
push ebx
push ebx
call dword [sym.imp.kernel32.dll_CreateMutexA]
mov dword [ebp - 0x438], eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov byte [ebp - 0x120], bl
call esi
push eax
push str.java_plug_in_jvm_loaded:ver1.1_d
lea eax, [ebp - 0x120]
push eax
call fcn.6d854575
add esp, 0xc
mov byte [ebp - 0x224], bl
call esi
push eax
push str.java_plug_in_10.0.0_jvm_loaded:ver1.1_d
lea eax, [ebp - 0x224]
push eax
call fcn.6d854575
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
push ebx
mov edi, 0x1f0003
push edi
mov esi, dword [sym.imp.kernel32.dll_OpenEventA]
call esi
mov dword [ebp - 0x430], eax
cmp eax, ebx
je 0x6d841d23
lea eax, [ebp - 0x224]
push eax
push ebx
push edi
call esi
mov dword [ebp - 0x434], eax
cmp eax, ebx
jne 0x6d841d23
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x6d85dbf4
call fcn.6d84a780
add esp, 0xc
xor eax, eax
jmp 0x6d841d8c
push 0x104
lea eax, [ebp - 0x42c]
push eax
push dword [0x6d85ea6c]
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
lea eax, [ebp - 0x120]
push eax
xor edi, edi
inc edi
push edi
push ebx
push ebx
mov esi, dword [sym.imp.kernel32.dll_CreateEventA]
call esi
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x224]
push eax
push edi
push ebx
push ebx
call esi
mov dword [ebp - 0x434], eax
mov dword [0x6d85ea68], edi
mov dword [ebp - 4], 0xfffffffe
call fcn.6d841d94
mov eax, dword [0x6d85ea68]
call fcn.6d84a5d8
ret
Function at 0x6d842183
Capabilities:
Delete registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x6d85dbf4]
xor eax, ebp
mov dword [ebp + 0x19c], eax
push ebx
push esi
push edi
mov edi, 0x6d85d1ac
xor ebx, ebx
mov eax, dword [edi - 4]
mov esi, dword [edi + 4]
mov dword [ebp - 0x80], eax
mov eax, dword [edi]
mov dword [ebp - 0x70], eax
cmp esi, 0xffffffff
jne 0x6d8421fa
lea eax, [ebp + 0x98]
push eax
mov byte [ebp + 0x98], bl
call fcn.6d841ea4
pop ecx
test eax, eax
je 0x6d842276
push dword [0x6d85d1a4]
lea eax, [ebp + 0x98]
push eax
lea eax, [ebp - 0x6c]
push str._s_s
push eax
mov byte [ebp - 0x6c], bl
call fcn.6d854575
add esp, 0x10
lea esi, [ebp - 0x6c]
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push dword [ebp - 0x80]
lea ecx, [ebp - 0x7c]
push 0x80000000
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
call fcn.6d854575
cmp eax, ebx
jne 0x6d84226e
push 0xffffffffffffffff
push ebx
push dword [ebp - 0x70]
lea ecx, [ebp - 0x7c]
cmp esi, ebx
je 0x6d842237
push esi
call fcn.6d854575
mov esi, eax
jmp 0x6d84224f
push 0x6d855641
call fcn.6d854575
push dword [ebp - 0x70]
mov esi, eax
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp esi, ebx
jne 0x6d84226e
lea ecx, [ebp - 0x7c]
call fcn.6d841078
add edi, 0x10
cmp edi, 0x6d85d23c
jl 0x6d8421a8
xor eax, eax
jmp 0x6d84227b
lea ecx, [ebp - 0x7c]
call fcn.6d841078
mov eax, 0x80040201
mov ecx, dword [ebp + 0x19c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d84a2c3
add ebp, 0x1a0
leave
ret

Function at 0x6d842670
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x6d85dbf4]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.6d854575
mov ebx, eax
cmp ebx, esi
je 0x6d8426e3
lea ecx, [ebp - 0x74]
call fcn.6d841078
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d84a2c3
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x6d8426fb
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.6d842670
cmp eax, esi
jne 0x6d84272d
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x6d8426eb
lea ecx, [ebp - 0x74]
call fcn.6d841078
push dword [ebp - 0x78]
mov ecx, edi
call fcn.6d84192a
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.6d841078
mov eax, esi
jmp 0x6d8426c9

Function at 0x6d8429e4
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8
Function at 0x6d842a32
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x6d842a43
push 0xd
pop eax
jmp 0x6d842a6d
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x6d842a46
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8