joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d7110
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov ecx, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
test byte [ecx + 6], 0x20
je 0x4d71a7
movzx eax, byte [ecx]
movzx edx, byte [ecx + 2]
shl eax, 0x10
or edx, eax
movzx eax, byte [ecx + 1]
shl eax, 8
or edx, eax
mov eax, edx
and edx, 0xfff
sar eax, 0xc
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
movzx eax, byte [ecx + 3]
shr al, 4
movzx eax, al
mov dword [ebx + 0xc], eax
movzx eax, byte [ecx + 3]
and eax, 0xf
mov dword [ebx + 0x10], eax
mov eax, dword [eax*4 + 0xb13080]
mov dword [ebx + 0x14], eax
movzx edx, byte [ecx + 5]
movzx eax, byte [ecx + 4]
shl edx, 2
shl eax, 0xa
or edx, eax
movzx eax, byte [ecx + 6]
mov dword [ebx], 1
mov dword [ebx + 0x1c], 3
mov dword [ebx + 0x30], 0x64
shr al, 6
movzx eax, al
or edx, eax
xor eax, eax
mov dword [ebx + 0x18], edx
add esp, 0x18
pop ebx
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x14
mov dword [esp + 4], 1
mov dword [esp], 0xb13060
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
add esp, 0x18
mov eax, 1
pop ebx
ret
Function at 0x5280b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x18], esi
mov eax, dword [ebx + 0x48]
test eax, eax
jne 0x528150
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x528170
mov esi, dword [ebx + 0x54]
mov edx, dword [ebx + 0x34]
mov eax, dword [ebx + 0x30]
mov ecx, dword [esi + 0x3c]
xor eax, dword [esi + 0x38]
xor ecx, edx
or ecx, eax
je 0x528109
mov dword [esp + 8], 0xb1c490
mov dword [esp + 4], 1
mov dword [esp], 0x15
call fcn.00405fb0
mov esi, dword [ebx + 0x54]
mov eax, dword [esi + 8]
mov dword [esp], esi
mov dword [esp + 8], eax
lea eax, [ebx + 0x64]
mov dword [esp + 4], eax
call fcn.00527f70
test eax, eax
mov ecx, eax
jle 0x528148
mov edx, ecx
sar edx, 0x1f
add dword [ebx + 0x30], eax
adc dword [ebx + 0x34], edx
mov dword [ebx + 0x28], eax
mov eax, ecx
mov dword [ebx + 0x24], 0
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
add esp, 0x1c
ret
mov dword [ebx + 0x48], 1
nop
mov dword [ebx + 0x28], 0
xor ecx, ecx
mov dword [ebx + 0x24], 0
mov ebx, dword [esp + 0x14]
mov eax, ecx
mov esi, dword [esp + 0x18]
add esp, 0x1c
ret
mov dword [esp + 0x20], ebx
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
add esp, 0x1c
jmp fcn.00528d80

Function at 0x5281a0
Capabilities:
Terminate thread

Disassembly:
sub esp, 0x1c
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x18], esi
mov eax, dword [ebx + 0x50]
mov esi, dword [ebx + 0x54]
test eax, eax
jne 0x5281c5
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
add esp, 0x1c
ret
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_TerminateThread
mov eax, dword [esi + 0x40]
sub esp, 8
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [esi]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x54]
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x20], eax
add esp, 0x1c
jmp sub.msvcrt.dll_free
Function at 0x5282b0
Capabilities:
Create thread

Disassembly:
push ebp
mov edx, 0x914
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [esp + 0x60]
mov ebx, dword [esp + 0x6c]
mov eax, dword [edi + 0x18]
cmp eax, 1
je 0x5282da
cmp eax, 2
je 0x5284a5
mov edx, 0x800
mov eax, dword [esp + 0x64]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00528210
test eax, eax
mov ebp, eax
je 0x528494
mov dword [edi + 0x54], eax
mov dword [eax + 0x40], edi
mov dword [eax + 0x14], ebx
mov eax, dword [eax + 4]
sub eax, dword [ebp + 0x10]
cmp ebx, eax
jle 0x52830a
mov dword [ebp + 0x14], eax
mov esi, dword [esp + 0x68]
cmp esi, eax
jg 0x52849e
mov dword [esp], 0x998
call sub.msvcrt.dll_malloc
mov ebx, eax
mov eax, dword [ebp + 0x40]
mov dword [esp + 8], 0x998
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
lea eax, [esp + 0x44]
mov dword [ebp + 0x40], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x528bc0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 0x18]
sub esp, 0x18
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x28]
mov edx, dword [ebp + 0x2c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
mov eax, dword [ebp + 0x38]
mov edx, dword [ebp + 0x3c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0x24]
mov dword [esp + 8], 0xb1c4e0
mov dword [esp + 4], 6
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
mov dword [esp], 0x15
call fcn.00405fb0
mov eax, esi
sar eax, 0x1f
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], eax
jmp 0x52843c
cmp ecx, dword [ebp + 0x20]
jae 0x528449
lea esi, [esi]
mov eax, dword [ebp + 0x28]
mov edx, dword [ebp + 0x2c]
sub eax, ecx
sbb edx, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
push edx
push eax
fild qword [esp]
add esp, 8
fmul dword [0xb1c62c]
fild dword [ebp + 4]
fdivp st(1)
mov dword [esp + 8], 0xb1c518
mov dword [esp + 4], 5
mov dword [esp], 0x15
fstp qword [esp + 0xc]
call fcn.00405fb0
mov eax, dword [ebp + 0x18]
test eax, eax
jne 0x52845f
mov dword [esp], 0xc8
call fcn.00401450
test eax, eax
jne 0x528494
mov ebx, dword [ebp + 0x3c]
cmp ebx, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x38]
jl 0x5283e0
jle 0x5283d4
mov eax, dword [ebp + 0x28]
mov edx, dword [ebp + 0x2c]
mov esi, eax
sub esi, ecx
mov edi, edx
sbb edi, ebx
cmp edi, dword [esp + 0x34]
jl 0x5283e6
jle 0x528488
mov dword [esp + 8], 0xb1c53e
mov dword [esp + 4], 5
mov dword [esp], 0x15
call fcn.00405fb0
mov eax, 1
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp esi, dword [esp + 0x30]
jb 0x5283e6
jmp 0x52845f
add esp, 0x4c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, eax
jmp 0x528316
mov eax, dword [edi + 0x14]
test eax, eax
jns 0x5282d5
mov dword [esp + 8], 0xb1c4c0
mov dword [esp + 4], 5
mov dword [esp], 0x15
call fcn.00405fb0
mov eax, 1
jmp 0x528480
Function at 0x528d80
Capabilities:
Read file on windows

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx + 0x48]
test eax, eax
jne 0x528dc7
mov eax, dword [ebx + 0x18]
cmp eax, 2
je 0x528de0
cmp eax, 8
je 0x528e25
mov edx, dword [ebx]
test edx, edx
je 0x528dc0
lea eax, [ebx + 0x64]
mov dword [esp + 8], 0x800
mov dword [esp + 4], eax
mov dword [esp], ebx
call edx
mov ecx, eax
test ecx, ecx
jg 0x528e09
mov dword [ebx + 0x48], 1
mov dword [ebx + 0x28], 0
xor ecx, ecx
mov dword [ebx + 0x24], 0
add esp, 0x18
mov eax, ecx
pop ebx
ret
mov edx, dword [ebx + 0x60]
test edx, edx
je 0x528e43
lea eax, [ebx + 0x64]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x800
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call dword [edx + 0x20]
mov ecx, eax
test ecx, ecx
jle 0x528dc0
mov edx, ecx
mov eax, ecx
sar edx, 0x1f
add dword [ebx + 0x30], ecx
adc dword [ebx + 0x34], edx
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], ecx
add esp, 0x18
pop ebx
ret
lea eax, [ebx + 0x64]
mov dword [esp + 8], 0x800
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x58]
mov dword [esp], eax
call fcn.004c54c0
mov ecx, eax
jmp 0x528e05
lea eax, [ebx + 0x64]
mov dword [esp + 8], 0x800
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x14]
mov dword [esp], eax
call sub.msvcrt.dll__read
mov ecx, eax
jmp 0x528e05

Function at 0x529200
Capabilities:
Initialize winsock library

Disassembly:
push ebx
xor ebx, ebx
sub esp, 0x1a8
mov dword [esp], 0x998
call sub.msvcrt.dll_malloc
test eax, eax
je 0x5292e4
mov ebx, eax
mov dword [esp + 8], 0x998
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_memset
lea eax, [esp + 0x18]
mov dword [esp + 4], eax
mov dword [esp], 0x202
call sub.WS2_32.DLL_WSAStartup
sub esp, 8
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xb1c6d7
mov dword [esp + 4], 6
mov dword [esp], 0x14
call fcn.00405fb0
mov eax, dword [esp + 0x1b0]
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x14], eax
mov eax, dword [esp + 0x1b4]
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x48]
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x50], 0
test eax, eax
jne 0x5292f0
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x5292e4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call eax
mov eax, ebx
add esp, 0x1a8
pop ebx
ret
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x48], 0
jmp 0x5292c8
Function at 0x57f1e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], ebp
mov dword [esp], 0x14
call sub.msvcrt.dll_malloc
mov dword [esp + 4], 0xb283b0
mov ebx, eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
test eax, eax
mov dword [esp + 0x28], eax
je 0x57f24d
lea ebp, [esp + 0x2c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x20
mov dword [esp], ebp
call sub.msvcrt.dll_fread
test eax, eax
jne 0x57f270
mov edx, dword [esp + 0x28]
mov dword [esp], edx
call sub.msvcrt.dll_fclose
mov dword [esp], ebx
xor ebx, ebx
call sub.msvcrt.dll_free
mov eax, ebx
mov esi, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
cld
mov edi, 0xb283b3
mov ecx, 6
mov esi, ebp
repe cmpsb byte [esi], byte es:[edi]
jne 0x57f241
movzx eax, byte [esp + 0x34]
movzx edx, byte [esp + 0x35]
shl eax, 8
add eax, edx
mov dword [ebx + 8], eax
movzx eax, byte [esp + 0x36]
movzx edx, byte [esp + 0x37]
shl eax, 8
add eax, edx
mov dword [ebx + 0xc], eax
movzx eax, byte [esp + 0x38]
movzx edx, byte [esp + 0x39]
shl eax, 8
add eax, edx
mov edx, dword [ebx + 8]
mov dword [ebx + 0x10], eax
test edx, edx
jne 0x57f2e7
movzx eax, byte [esp + 0x48]
movzx edx, byte [esp + 0x49]
shl eax, 8
add eax, edx
movzx edx, byte [esp + 0x4a]
shl eax, 8
add eax, edx
movzx edx, byte [esp + 0x4b]
shl eax, 8
add eax, edx
mov dword [ebx + 8], eax
mov eax, dword [ebx + 0x10]
cmp eax, 0x100
jg 0x57f241
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0xc]
mov edx, dword [esp + 0x60]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0xb283ba
mov dword [esp + 4], 7
mov dword [esp + 0x10], eax
mov dword [esp], 0x1e
call fcn.00405fb0
mov eax, dword [ebx + 0x10]
test eax, eax
jne 0x57f386
mov dword [ebx + 4], 0
mov esi, 3
mov eax, dword [ebx + 8]
imul eax, dword [ebx + 0xc]
imul eax, esi
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, dword [esp + 0x28]
mov dword [ebx], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov edx, dword [ebx + 8]
imul edx, dword [ebx + 0xc]
mov dword [esp], eax
imul edx, esi
mov dword [esp + 4], edx
call sub.msvcrt.dll_fread
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
jmp 0x57f257
lea eax, [eax + eax*2]
mov esi, 1
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, dword [esp + 0x28]
mov dword [ebx + 4], eax
mov dword [esp + 0xc], edx
mov edx, dword [ebx + 0x10]
mov dword [esp + 4], 3
mov dword [esp], eax
mov dword [esp + 8], edx
call sub.msvcrt.dll_fread
jmp 0x57f33b
Function at 0x757f60
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push ebp
sub ecx, 1
push edi
mov ebp, edx
push esi
push ebx
sub esp, 0x1c
mov edi, dword [edx]
mov dword [esp + 0x18], eax
lea esi, [ecx + ecx]
mov eax, 0xfffffffe
lea esi, [esi]
cmp eax, ecx
jbe 0x757f90
neg eax
test eax, eax
jns 0x757f80
add eax, esi
cmp eax, ecx
ja 0x757f84
imul eax, dword [esp + 0x30]
mov ebx, 0xfffffffe
mov edx, 0xfffffffe
mov eax, dword [edi + eax*4]
test eax, eax
je 0x758030
lea esi, [esi]
cmp edx, ecx
jbe 0x757fc0
neg edx
test edx, edx
jns 0x757fb0
add edx, esi
cmp edx, ecx
ja 0x757fb4
imul edx, dword [esp + 0x30]
mov ebx, dword [edi + edx*4]
mov eax, dword [esp + 0x18]
mov dword [eax], ebx
mov eax, 0xffffffff
cmp eax, ecx
jbe 0x757fe3
neg eax
test eax, eax
jns 0x757fd3
add eax, esi
cmp eax, ecx
ja 0x757fd7
imul eax, dword [esp + 0x30]
mov ebx, 0xffffffff
mov edx, 0xffffffff
mov eax, dword [edi + eax*4]
test eax, eax
je 0x758073
lea esi, [esi]
cmp edx, ecx
jbe 0x758010
neg edx
test edx, edx
jns 0x758000
add edx, esi
cmp edx, ecx
ja 0x758004
imul edx, dword [esp + 0x30]
mov ecx, dword [edi + edx*4]
mov eax, dword [esp + 0x18]
mov dword [eax + 4], ecx
mov dword [eax + 0x10], 0xffffffff
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
add ebx, esi
cmp ebx, ecx
jbe 0x75803e
neg ebx
test ebx, ebx
js 0x75802e
cmp ebx, ecx
ja 0x758034
mov edx, dword [ebp + 8]
test edx, edx
js 0x7580a8
imul ebx, dword [esp + 0x30]
mov dword [esp + 0x14], ebx
mov ebx, dword [edi + ebx*4]
test ebx, ebx
jne 0x757fc8
mov eax, dword [ebp + 4]
mov ebx, dword [eax + edx*4]
lea eax, [edx - 1]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x14]
mov dword [edi + eax*4], ebx
jmp 0x757fc8
add ebx, esi
cmp ebx, ecx
jbe 0x758081
neg ebx
test ebx, ebx
js 0x758071
cmp ebx, ecx
ja 0x758077
mov edx, dword [ebp + 8]
test edx, edx
js 0x7580a8
imul ebx, dword [esp + 0x30]
mov ecx, dword [edi + ebx*4]
test ecx, ecx
jne 0x758018
mov eax, dword [ebp + 4]
mov ecx, dword [eax + edx*4]
lea eax, [edx - 1]
mov dword [ebp + 8], eax
mov dword [edi + ebx*4], ecx
jmp 0x758018
mov dword [esp + 8], 0x208
mov dword [esp + 4], 0xb67a81
mov dword [esp], 0xb67ccb
call sub.msvcrt.dll__assert
lea esi, [esi]
lea edi, [edi]
Function at 0x910800
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x18]
mov dword [esp], ebx
mov dword [esp + 4], esi
mov dword [esp + 8], edi
lea eax, [ecx - 8]
cmp eax, 0x18
jbe 0x91082e
mov eax, 0xffffffff
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0xc
ret
xor esi, esi
xor eax, eax
mov ebx, dword [esp + 0x1c]
xor edx, edx
test cl, 0x20
setne dl
sete al
shl edx, cl
shl eax, cl
cmp esi, edx
jg 0x91081a
jge 0x910981
cmp dword [esp + 0x20], 0x404
je 0x910863
cmp dword [esp + 0x20], 0x1000
jne 0x91081a
mov esi, 0x20
xor ebx, ebx
sub esi, ecx
jmp 0x910901
mov eax, ebx
mov edx, ebx
and eax, 1
neg eax
and eax, dword [esp + 0x1c]
shr edx, 1
xor eax, edx
mov edx, eax
and edx, 1
neg edx
and edx, dword [esp + 0x1c]
shr eax, 1
xor edx, eax
mov eax, edx
and eax, 1
neg eax
and eax, dword [esp + 0x1c]
shr edx, 1
xor eax, edx
mov edx, eax
and edx, 1
neg edx
and edx, dword [esp + 0x1c]
shr eax, 1
xor edx, eax
mov eax, edx
and eax, 1
neg eax
and eax, dword [esp + 0x1c]
shr edx, 1
xor eax, edx
mov edx, eax
and edx, 1
neg edx
and edx, dword [esp + 0x1c]
shr eax, 1
xor edx, eax
mov ecx, edx
and ecx, 1
neg ecx
and ecx, dword [esp + 0x1c]
shr edx, 1
xor ecx, edx
mov edx, dword [esp + 0x10]
mov eax, ecx
and eax, 1
neg eax
and eax, dword [esp + 0x1c]
shr ecx, 1
xor eax, ecx
mov dword [edx + ebx*4], eax
add ebx, 1
cmp ebx, 0x100
je 0x91098e
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x910871
mov edi, dword [esp + 0x1c]
mov edx, ebx
mov ecx, esi
shl edx, 0x18
mov eax, ebx
sar edx, 0x1f
shl eax, 0x19
shl edi, cl
and edx, edi
xor edx, eax
mov eax, edx
add edx, edx
sar eax, 0x1f
and eax, edi
xor eax, edx
mov edx, eax
add eax, eax
sar edx, 0x1f
and edx, edi
xor edx, eax
mov eax, edx
add edx, edx
sar eax, 0x1f
and eax, edi
xor eax, edx
mov edx, eax
add eax, eax
sar edx, 0x1f
and edx, edi
xor edx, eax
mov eax, edx
add edx, edx
sar eax, 0x1f
and eax, edi
xor eax, edx
mov edx, eax
add eax, eax
sar edx, 0x1f
and edx, edi
xor edx, eax
mov eax, edx
add edx, edx
sar eax, 0x1f
and eax, edi
xor eax, edx
mov edx, dword [esp + 0x10]
bswap eax
mov dword [edx + ebx*4], eax
jmp 0x9108f2
cmp ebx, eax
jae 0x91081a
jmp 0x91084f
mov ecx, dword [esp + 0x10]
mov dword [ecx + 0x400], 1
xor ecx, ecx
cmp dword [esp + 0x20], 0xfff
jbe 0x9109ea
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx + ecx*4]
movzx edx, al
shr eax, 8
xor eax, dword [ebx + edx*4]
movzx edx, al
mov dword [ebx + ecx*4 + 0x400], eax
shr eax, 8
xor eax, dword [ebx + edx*4]
movzx edx, al
mov dword [ebx + ecx*4 + 0x800], eax
shr eax, 8
xor eax, dword [ebx + edx*4]
mov dword [ebx + ecx*4 + 0xc00], eax
add ecx, 1
cmp ecx, 0x100
jne 0x9109a8
xor eax, eax
jmp 0x91081f
Function at 0x934d70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 8]
mov dword [esp + 4], 0xbcde79
mov dword [esp], ebx
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x934e80
lea eax, [ebp - 8]
mov dword [esp + 0x20], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xbcde85
mov dword [esp], 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
sub esp, 0x24
test eax, eax
jne 0x934f86
mov eax, dword [ebp - 0xc]
lea ebx, [ebp + 0xc]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0xbcdecb
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
test eax, eax
jne 0x934f70
mov dword [ebp + 0xc], 0xffffffff
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0xbcdf16
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
test eax, eax
jne 0x934f70
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
sub esp, 4
mov ebx, dword [ebp - 4]
leave
ret
mov dword [esp + 4], 0xbcde66
mov dword [esp], ebx
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x934f11
lea eax, [ebp - 8]
mov dword [esp + 0x20], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xbcdf30
mov dword [esp], 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
sub esp, 0x24
test eax, eax
jne 0x934f86
lea eax, [ebp + 0xc]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
jmp 0x934e4f
mov dword [esp + 4], 0xbcde81
mov dword [esp], ebx
call sub.msvcrt.dll__stricmp
test eax, eax
je 0x934e94
mov dword [esp + 4], 0xbcde5d
mov dword [esp], ebx
call sub.msvcrt.dll__stricmp
test eax, eax
je 0x934e94
mov dword [esp + 4], 0xbcde52
mov dword [esp], ebx
call sub.msvcrt.dll__stricmp
test eax, eax
je 0x934e94
mov dword [esp], 0xbcdf51
call sub.msvcrt.dll_puts
mov eax, 0xffffff38
jmp 0x934e75
mov dword [esp], 0xbcdee8
call sub.msvcrt.dll_puts
mov eax, 0xffffffff
jmp 0x934e75
mov dword [esp], 0xbcdea0
call sub.msvcrt.dll_puts
mov eax, 0xffffffff
jmp 0x934e75
Function at 0x9c2dc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov dword [ebp - 4], edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
cmp edi, 8
jg 0x9c2e41
mov ebx, 8
mov ecx, edi
mov eax, ebx
lea esi, [ebp - 0x810]
shl eax, cl
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 0
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.009c2af0
lea ecx, [edi - 1]
shl ebx, cl
mov ecx, dword [ebp + 0xc]
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
lea eax, [ebx + ecx]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x12
mov dword [esp + 4], 1
mov dword [esp], 0xbfa952
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
call sub.msvcrt.dll_exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x9f17d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push ebx
test edi, edi
jle 0x9f19e1
mov ebx, dword [ebp + 8]
lea ecx, [edi - 1]
movzx eax, byte [esi]
and ecx, 7
movzx edx, word [ebx]
xor eax, edx
movzx ebx, al
sar edx, 8
xor edx, dword [ebx*4 + 0xaebe70]
mov ebx, 1
cmp ebx, edi
mov eax, edx
je 0x9f19db
test ecx, ecx
je 0x9f190c
cmp ecx, 1
je 0x9f18e9
cmp ecx, 2
je 0x9f18cd
cmp ecx, 3
nop
je 0x9f18b1
cmp ecx, 4
je 0x9f1895
cmp ecx, 5
je 0x9f1879
cmp ecx, 6
nop
je 0x9f185d
movzx eax, byte [esi + 1]
movzx edx, dx
mov bl, 2
xor eax, edx
movzx ecx, al
movzx eax, word [ecx*4 + 0xaebe70]
sar edx, 8
xor eax, edx
movzx edx, ax
movzx eax, byte [ebx + esi]
add ebx, 1
xor eax, edx
movzx ecx, al
movzx eax, word [ecx*4 + 0xaebe70]
sar edx, 8
xor eax, edx
movzx edx, ax
movzx eax, byte [ebx + esi]
add ebx, 1
xor eax, edx
movzx ecx, al
movzx eax, word [ecx*4 + 0xaebe70]
sar edx, 8
xor eax, edx
movzx edx, ax
movzx eax, byte [ebx + esi]
add ebx, 1
xor eax, edx
movzx ecx, al
movzx eax, word [ecx*4 + 0xaebe70]
sar edx, 8
xor eax, edx
movzx edx, ax
movzx eax, byte [ebx + esi]
add ebx, 1
xor eax, edx
movzx ecx, al
movzx eax, word [ecx*4 + 0xaebe70]
sar edx, 8
xor eax, edx
movzx edx, ax
movzx eax, byte [ebx + esi]
add ebx, 1
xor eax, edx
movzx ecx, al
movzx eax, word [ecx*4 + 0xaebe70]
sar edx, 8
xor eax, edx
movzx edx, ax
movzx eax, byte [ebx + esi]
add ebx, 1
xor eax, edx
movzx ecx, al
sar edx, 8
xor edx, dword [ecx*4 + 0xaebe70]
cmp ebx, edi
mov eax, edx
je 0x9f19db
movzx ecx, ax
movzx eax, byte [ebx + esi]
xor eax, ecx
movzx edx, al
movzx eax, word [edx*4 + 0xaebe70]
sar ecx, 8
movzx edx, byte [ebx + esi + 1]
xor eax, ecx
movzx eax, ax
xor edx, eax
movzx ecx, dl
movzx edx, byte [ebx + esi + 2]
sar eax, 8
xor ax, word [ecx*4 + 0xaebe70]
movzx eax, ax
xor edx, eax
movzx ecx, dl
movzx edx, byte [ebx + esi + 3]
sar eax, 8
xor ax, word [ecx*4 + 0xaebe70]
movzx eax, ax
xor edx, eax
movzx ecx, dl
movzx edx, byte [ebx + esi + 4]
sar eax, 8
xor ax, word [ecx*4 + 0xaebe70]
movzx eax, ax
xor edx, eax
movzx ecx, dl
movzx edx, byte [ebx + esi + 5]
sar eax, 8
xor ax, word [ecx*4 + 0xaebe70]
movzx eax, ax
xor edx, eax
movzx ecx, dl
movzx edx, byte [ebx + esi + 6]
sar eax, 8
xor ax, word [ecx*4 + 0xaebe70]
movzx ecx, ax
movzx eax, byte [ebx + esi + 7]
add ebx, 8
xor edx, ecx
movzx edx, dl
movzx edx, word [edx*4 + 0xaebe70]
sar ecx, 8
xor edx, ecx
movzx edx, dx
xor eax, edx
movzx ecx, al
sar edx, 8
xor edx, dword [ecx*4 + 0xaebe70]
cmp ebx, edi
mov eax, edx
jne 0x9f190c
mov eax, dword [ebp + 8]
mov word [eax], dx
pop ebx
pop esi
pop edi
pop ebp
ret