joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020de1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x20202020]
push 0xffffffffffffffff
push 0x100546bb
push eax
mov dword fs:[0x20202020], esp
sub esp, 0x28
mov eax, dword fs:[0x2020202c]
mov ecx, dword [edx]
and byte [edi], bl
movups xmm1, xmmword [ebx - 0x7b5e77f4]
fiadd dword [edi]
adc byte [ebx], bh
add dword [eax], 0x8f0f2020
movsd dword es:[edi], dword [esi]
add dword [eax], esp
and byte [ebx + 0x56], dl
mov dword [ebp - 0x14], 0x1007da64
call dword [0x100560f4]
mov edx, eax
mov esi, 0x1007da64
cmp edx, dword [0x1007da64]
je 0x10020e52
mov ecx, edx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x10020e52
pause
push edx
mov ecx, esi
call 0x30225621
jmp 0x10020e59
lock inc dword [0x1007da68]
mov dword [ebp - 4], 0x20202002
cmp byte [0x10078080], 0x20
jne 0x10020e70
xor ebx, ebx
jmp 0x30220f94
lea eax, [ebp + 8]
mov ecx, 0x10078090
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1001dec1
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebp + 8]
cmp byte [ebx + 0xa], 0x20
jne 0x10020eb0
push dword [ebx + 0x10]
mov ecx, 0x10078090
push esi
call fcn.1001f881
test al, al
jne 0x10020eb0
cmp ebx, dword [0x10078090]
je 0x10020eb0
mov ebx, dword [ebx + 0x10]
jmp 0x30222f8f
push edi
push 0x202020b0
call 0x3003e547
mov ebx, eax
add esp, 4
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
mov ecx, 0x2020202c
mov edi, ebx
push eax
mov dword [ebx + 0x202020a0], 0x20202020
lea eax, [ebp - 0x34]
mov dword [ebx + 0x202020a8], 0x20202020
mov dword [ebx + 0x202020ac], 0x20202020
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, 0x10078090
call fcn.1001dec1
mov ecx, dword [eax + 4]
mov edi, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x10], ecx
cmp byte [eax + 0xa], 0x20
jne 0x10020f1f
push dword [eax + 0x10]
mov ecx, 0x10078090
push ebx
call fcn.1001f881
test al, al
je 0x10020f8e
cmp dword [0x10078094], 0x7fffffff
je 0x30223027
mov esi, dword [0x10078090]
mov dword [ebp - 0x1c], 0x10078090
mov dword [ebp - 0x18], 0x20202020
mov byte [ebp - 4], 3
push 0x14
mov dword [ebp - 0x18], 0x20202020
call 0x3003e547
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 4
mov dword [eax + 0x10], ebx
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov word [eax + 0xc], 0x2020
mov byte [ebp - 4], 5
mov dword [ebp - 0x18], 0x20202020
mov byte [ebp - 4], 2
mov ecx, 0x10078090
push eax
push dword [ebp - 0x10]
push edi
call 0x30223b91
pop edi
mov esi, 0x1007da64
mov dword [ebp - 4], 0xffffffff
lock dec dword [edx]
push 0x831007da
cmp eax, 0x1007da68
and byte [ebp + 4], dh
xor ecx, ecx
xchg dword [esi], ecx
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop esi
pop ebx
mov dword fs:[edx], ecx
and byte [eax], ah
and byte [eax], ah
mov esp, ebp
pop ebp
ret
Function at 0x1002ba01
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
cmp byte [ecx + 0x2020029c], 0x20
lea eax, [ecx + 0x2020029c]
mov dword [ebp - 0x10], eax
jne 0x3022db0b
push ebx
push esi
push edi
mov dword [ebp - 0x40], 0x1005a8dc
lea edi, [ebp - 0x40]
mov dword [ebp - 0x3c], 0x1005a8e0
mov esi, 0x20202001
mov dword [ebp - 0x38], 0x1005a8e4
mov dword [ebp - 0x34], 0x1005a8e8
mov dword [ebp - 0x30], 0x1005a8ec
mov dword [ebp - 0x2c], 0x1005a8f0
mov dword [ebp - 0x28], 0x1005a8f4
mov dword [ebp - 0x24], 0x1005a8f8
mov dword [ebp - 0x20], 0x1005a8fc
mov dword [ebp - 0x1c], 0x1005a920
mov dword [ebp - 0x18], 0x1005a904
mov dword [ebp - 0x14], 0x1005a908
jmp 0x1002ba81
push 3
push dword [edi]
push 0x10060a60
call 0x3003e3f6
add esp, 0xc
test eax, eax
je 0x1002ba9f
inc esi
add edi, 4
cmp esi, 0xc
jle 0x1002ba81
push 0x10060a64
call 0x3003e552
push 0x10060a67
mov ebx, eax
call 0x3003e552
mov edi, eax
mov dword [ebp - 0xc], 0x20202020
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x20202020
push eax
lea eax, [ebp - 8]
mov dword [ebp - 4], 0x20202020
push eax
lea eax, [ebp - 0xc]
push eax
push 0x1005a90c
push 0x10060a54
call fcn.10010ae1
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
push esi
mov esi, dword [ebp - 0x10]
push edi
push 0x1005a91c
push 0xf
push esi
call fcn.1000b861
add esp, 0x40
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10030171
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2020011c
push 0x20200120
lea eax, [ebp - 0x108]
mov dword [ebp - 0x11c], 0x2020011c
push 0x20
push eax
mov dword [ebp - 0x118], 0x20202020
mov dword [ebp - 0x114], 0x20202020
mov dword [ebp - 0x110], 0x20202020
mov dword [ebp - 0x10c], 0x20202020
call 0x30234b01
add esp, 0xc
mov dword [ebp - 4], 0x20012020
xor eax, eax
mov dword [ebp - 8], eax
push 1
push 0x20202080
push eax
push eax
call dword [0x10056050]
push edx
push eax
push 0x20202080
lea eax, [ebp - 0x11c]
push eax
call dword [0x10056098]
test eax, eax
sete al
mov esp, ebp
pop ebp
ret
Function at 0x10001b40
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
jne 0x10001bd8
push str.avifil32.dll
call fcn.10004f5c
test al, al
jne 0x10001b5d
pop esi
ret
push str.AVIFileInit
push dword [esi + 4]
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileExit
push dword [esi + 4]
mov dword [esi + 8], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileRelease
push dword [esi + 4]
mov dword [esi + 0xc], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileOpen
push dword [esi + 4]
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIStreamInfo
push dword [esi + 4]
mov dword [esi + 0x14], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIStreamOpenFromFile
push dword [esi + 4]
mov dword [esi + 0x18], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIStreamRelease
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
mov byte [esi + 0x24], 1
mov al, 1
pop esi
ret

Function at 0x10001c20
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
jne 0x10001cb8
push str.winmm.dll
call fcn.10004f5c
test al, al
jne 0x10001c3d
pop esi
ret
push str.mmioInstallIOProcA
push dword [esi + 4]
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioOpenA
push dword [esi + 4]
mov dword [esi + 8], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioClose
push dword [esi + 4]
mov dword [esi + 0xc], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioAscend
push dword [esi + 4]
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioRead
push dword [esi + 4]
mov dword [esi + 0x14], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioDescend
push dword [esi + 4]
mov dword [esi + 0x18], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mciSendCommandA
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
mov byte [esi + 0x24], 1
mov al, 1
pop esi
ret

Function at 0x10009670
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
cmp eax, 0x1a
jl 0x100096c8
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jl 0x100096c8
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push 0x10
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi]
push eax
push dword [esi + 4]
push dword [esi]
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.10004f5c
push 1
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4

Function at 0x10009c50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8
Function at 0x10110860
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023e79b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x102e9794]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x101108a9
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
cmp dword [0x102e354c], 0
jne 0x101108c0
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
test esi, esi
je 0x1011090d
mov eax, dword [esi]
test eax, eax
je 0x10110892
cmp dword [esi + 4], 0
je 0x10110892
push eax
call fcn.101fa9d0
add esp, 4
push dword [esi + 4]
call fcn.101fa9d0
mov eax, dword [esi + 0xc]
add esp, 4
test eax, eax
je 0x101108fe
push eax
call fcn.101fa9d0
add esp, 4
mov eax, dword [esi + 8]
test eax, eax
je 0x10110945
push eax
call fcn.101fa9d0
jmp 0x10110942
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
call fcn.101fa9d0
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
call fcn.101fa9d0
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
call fcn.101fa9d0
add esp, 4
push dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call fcn.101fa9d0
add esp, 4
push 8
call fcn.101fa9d0
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x10110980
push dword [ebp + 0x18]
mov ecx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.101fa9d0
mov dword [edi], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [edi], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1019c030
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023ff89
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x102e9794]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], 0
call sym.AIDE.dll_public:_void___thiscall_AIDE::PaletteInfo::constructor_void_
mov ecx, dword [edi + 0x14]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
call fcn.1019d620
mov dword [esi], eax
lea ecx, [edi + 0x28]
mov dword [esi + 4], 3
mov dword [esi + 8], 0
mov dword [ecx], 8
mov dword [edi + 0x30], 8
mov dword [edi + 0x2c], 8
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 8
mov ecx, dword [edi + 0x14]
call fcn.1019d600
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10209e80
Capabilities:
Terminate process

Disassembly:
cmp dword [str._AdobeIP0000539_], 0
jne 0x10209e91
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
jmp 0x1023bf90
movss xmm5, dword [0x102bd82c]
movss xmm4, dword [0x102bd834]
movss xmm6, dword [0x102bd828]
movss xmm7, dword [0x102bd820]
movss xmm3, dword [0x1027b890]
push esi
xor esi, esi
nop dword [eax + eax]
movd xmm0, esi
mov eax, esi
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
sub esp, 8
addsd xmm0, qword [eax*8 + 0x102d46d0]
cvtpd2ps xmm2, xmm0
movaps xmm0, xmm4
movaps xmm1, xmm2
mulss xmm1, xmm5
subss xmm0, xmm1
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.101fa9d0
movaps xmm0, xmm2
mov ecx, eax
mulss xmm0, xmm6
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.101fa9d0
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, xmm7
add ecx, eax
mov dword [esi*4 + 0x102fc9f0], ecx
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.101fa9d0
movaps xmm0, xmm2
mov edx, eax
mulss xmm0, dword [0x102bd830]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.101fa9d0
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, dword [0x102bd818]
add eax, edx
mov dword [esi*4 + 0x102fd1f0], eax
mulss xmm0, xmm3
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.101fa9d0
movaps xmm0, xmm2
mov ecx, eax
mulss xmm0, dword [0x102bd824]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.101fa9d0
movaps xmm0, xmm2
shl eax, 0x10
mulss xmm0, dword [0x102bd81c]
add eax, ecx
mov dword [esi*4 + 0x102fcdf0], eax
mulss xmm0, xmm3
subss xmm0, xmm4
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.101fa9d0
movaps xmm0, xmm2
mov dword [esi*4 + 0x102fd5f0], eax
mulss xmm0, dword [0x102bd83c]
mov dword [esi*4 + 0x102fddf0], edx
mov dword [esi*4 + 0x102fd9f0], ecx
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.101fa9d0
movaps xmm0, xmm2
mov dword [esi*4 + 0x102fe1f0], eax
mulss xmm0, dword [0x102bd840]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.101fa9d0
movaps xmm0, xmm2
mov dword [esi*4 + 0x102fe5f0], eax
mulss xmm0, dword [0x102bd844]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.101fa9d0
mov dword [esi*4 + 0x102fe9f0], eax
mulss xmm2, dword [0x102bd838]
cvtps2pd xmm0, xmm2
movsd qword [esp], xmm0
call fcn.101fa9d0
mov dword [esi*4 + 0x102fedf0], eax
add esp, 8
inc esi
cmp esi, 0x100
jb 0x1023bfc0
pop esi
ret
Function at 0x1001ba93
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1001baa2
pop dword [ebp - 0x30]
mov eax, 0x1001baa2
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x6585317c
sub dword [ebp - 0x40], 0x1732ec31
mov dword [ebp - 0x3c], 0xff7f6193
sub dword [ebp - 0x3c], 0xcd4c154e
mov dword [ebp - 0x38], 0x98a36764
add dword [ebp - 0x38], 0xb3a8dcca
mov dword [ebp - 0x34], 0x506721f3
sub dword [ebp - 0x34], 0x506721f3
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xe6c51a86
sub dword [ebp - 0x40], 0x7252b130
mov dword [ebp - 0x3c], 0x660cd5b6
sub dword [ebp - 0x3c], 0x24a07441
mov dword [ebp - 0x38], 0xe39a6cd0
sub dword [ebp - 0x38], 0x802b0064
mov dword [ebp - 0x34], 0x8b7f9e7c
add dword [ebp - 0x34], 0x74806184
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3e5c3
push 0
call eax
mov ecx, 0x4c2e
mov edi, eax
mov ebx, 0xa0a2025f
add ebx, 0x6f6155a1
add ebx, dword [ebp - 0x30]
mov edx, 0x8859ce03
add dword [ebp - 4], ebx
mov esi, dword [ebx]
sub dword [ebp - 8], 0x86fe59c6
xor esi, edx
sub dword [ebp - 0x1c], 0x346d5a54
mov dword [edi], esi
xor dword [ebp - 0x1c], 0xc9c8357c
add edi, 0x84f77be3
sub edi, 0x84f77bdf
add ebx, 4
loop 0x1001bba9
add eax, 0x1238b
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x10001c50
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
jne 0x10001ce8
push str.avifil32.dll
call fcn.10005510
test al, al
jne 0x10001c6d
pop esi
ret
push str.AVIFileInit
push dword [esi + 4]
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileExit
push dword [esi + 4]
mov dword [esi + 8], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileRelease
push dword [esi + 4]
mov dword [esi + 0xc], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIFileOpen
push dword [esi + 4]
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIStreamInfo
push dword [esi + 4]
mov dword [esi + 0x14], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIStreamOpenFromFile
push dword [esi + 4]
mov dword [esi + 0x18], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.AVIStreamRelease
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
mov byte [esi + 0x24], 1
mov al, 1
pop esi
ret

Function at 0x10001d30
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
jne 0x10001dc8
push str.winmm.dll
call fcn.10005510
test al, al
jne 0x10001d4d
pop esi
ret
push str.mmioInstallIOProcA
push dword [esi + 4]
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioOpenA
push dword [esi + 4]
mov dword [esi + 8], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioClose
push dword [esi + 4]
mov dword [esi + 0xc], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioAscend
push dword [esi + 4]
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioRead
push dword [esi + 4]
mov dword [esi + 0x14], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mmioDescend
push dword [esi + 4]
mov dword [esi + 0x18], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.mciSendCommandA
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
mov byte [esi + 0x24], 1
mov al, 1
pop esi
ret
Function at 0x10005510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1000551f
pop dword [ebp - 0x10]
mov eax, 0xed4f4b3c
add eax, 0x22b109e3
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x1f68b8f8
sub dword [ebp - 0x20], 0xd11673ad
mov dword [ebp - 0x1c], 0xeca8a9fb
add dword [ebp - 0x1c], 0x458aa24a
mov dword [ebp - 0x18], 0x2e1794c3
sub dword [ebp - 0x18], 0xe1cb5095
mov dword [ebp - 0x14], 0x642ace48
add dword [ebp - 0x14], 0x9bd531b8
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x5c7eee13
add dword [ebp - 0x20], 0x17f37b43
mov dword [ebp - 0x1c], 0x2d1414b3
sub dword [ebp - 0x1c], 0xeba7b33e
mov dword [ebp - 0x18], 0x17c76778
add dword [ebp - 0x18], 0x4ba804f4
mov dword [ebp - 0x14], 0x19813328
sub dword [ebp - 0x14], 0x19813328
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3ae2b
push 0
call eax
mov ecx, 0x5096
mov esi, eax
mov edi, 0x10023800
add edi, dword [ebp - 0x10]
mov ebx, 0x94554175
add dword [ebp - 4], edx
mov edx, dword [edi]
mov dword [ebp - 0xc], 0x3e5238cc
xor edx, ebx
sub dword [ebp - 8], eax
mov dword [esi], edx
add dword [ebp - 8], 0x9ed5704f
add esi, 4
add edi, 0xc8053c86
sub edi, 0xc8053c82
loop 0x10005625
add eax, 0x1352b
mov ebx, eax
add eax, 0x5daa15ee
add eax, 0xa255ea17
mov ecx, 0xe34d224a
add ecx, 0x2cb2ddb6
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x10005720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x20]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [esi], eax
mov ecx, dword [ecx]
cmp ecx, dword [ebp + 0x10]
je 0x1000587f
mov eax, ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0x1c]
xor ebx, ebx
inc ebx
mov edi, 0x3ff
mov ecx, eax
cmp dword [esi], edx
je 0x1000587f
mov edx, dword [ebp + 8]
movzx ecx, word [eax]
mov eax, ecx
mov byte [ebp - 1], 0
movzx edx, word [edx]
cmp bx, dx
jae 0x1000579f
lea eax, [ecx + 0x2400]
cmp ax, di
ja 0x1000588e
mov eax, edx
lea ebx, [ecx - 0xdc00]
shl eax, 0xa
or ebx, eax
mov cl, byte [ebp - 1]
cmp ebx, 0x80
jae 0x100057bc
mov dl, bl
xor edi, edi
jmp 0x100057ec
mov ebx, eax
lea eax, [ecx + 0x2800]
cmp ax, di
ja 0x1000578e
add ebx, 0xffff2840
mov cl, 1
shl ebx, 0xa
mov byte [ebp - 1], cl
jmp 0x10005791
mov edx, ebx
cmp ebx, 0x800
jae 0x100057d1
shr edx, 6
xor edi, edi
or dl, 0xc0
inc edi
jmp 0x100057ec
cmp ebx, 0x10000
jae 0x100057e3
shr edx, 0xc
or dl, 0xe0
push 2
jmp 0x100057eb
shr edx, 0x12
or dl, 0xf0
push 3
pop edi
movzx eax, cl
mov ecx, dword [ebp - 0xc]
xor eax, 1
add eax, eax
cmp edi, 3
cmovb eax, edi
mov dword [ebp - 0x10], eax
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
sub eax, dword [esi]
cmp eax, dword [ebp - 8]
jl 0x1000587f
mov eax, ecx
mov ecx, dword [ebp + 0x14]
add eax, 2
cmp byte [ebp - 1], 0
mov dword [ecx], eax
jne 0x10005823
cmp edi, 3
jae 0x1000582e
mov eax, dword [esi]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [ebp - 0x10]
jmp 0x10005831
mov eax, dword [ebp - 8]
test eax, eax
je 0x10005856
imul ecx, edi, 6
sub ecx, 6
mov edx, ebx
dec eax
shr edx, cl
mov dword [ebp - 8], eax
and dl, 0x3f
mov eax, dword [esi]
or dl, 0x80
mov byte [eax], dl
inc dword [esi]
mov eax, dword [ebp - 8]
test eax, eax
jg 0x10005838
xor ecx, ecx
shr ebx, 0xa
inc ecx
movzx eax, bx
cmp byte [ebp - 1], 0
cmovne ecx, eax
mov eax, dword [ebp + 8]
mov word [eax], cx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [ebp + 0x10]
jne 0x10005749
xor eax, eax
cmp dword [ebp + 0xc], ecx
sete al
pop edi
pop esi
pop ebx
leave
ret 0x1c
push 2
pop eax
jmp 0x10005887

Function at 0x1000b110
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
cmp eax, 0x1a
jl 0x1000b168
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jl 0x1000b168
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
push 0x10
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi]
push eax
push dword [esi + 4]
push dword [esi]
push 0
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.10005510
push 1
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4
Function at 0x4023ab
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp + 0xc]
push esi
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x402404
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x104
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x402409
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
xor ebx, ebx
push ebx
push ebx
push ebx
mov dword [ebp - 4], ebx
push dword [ebp + 8]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x4024c7
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call fcn.004023ab
add esp, 0xc
test eax, eax
jne 0x4024ce
push esi
push edi
lea eax, [ebp - 0x20c]
push str.__1_
push eax
call fcn.004026e0
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x40249c
lea eax, [ebp - 0x20c]
push 0x407bb4
push eax
call fcn.004026e0
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x40249c
lea eax, [ebp - 0x20c]
push eax
call fcn.00402600
pop ecx
lea edi, [ebp + eax - 0x20d]
jmp 0x40249e
mov byte [edi], bl
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x407bb0
push edi
call esi
push dword [ebp + 8]
push edi
call esi
lea eax, [ebp - 0x20c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
cmp eax, 0x1f
pop esi
jbe 0x4024ce
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop ebx
leave
ret