joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40248e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b050]
jne 0x402498
repz ret
jmp fcn.00403f0f

Function at 0x408e28
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41b050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004055a8
and dword [ebp - 0x14], 0
cmp dword [0x41cf28], 0
mov dword [ebp - 0x18], eax
jne 0x408edb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408f83
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408f83
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41cf28], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41cf2c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41cf30], eax
call edi
push eax
call esi
mov dword [0x41cf38], eax
test eax, eax
je 0x408edb
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41cf34], eax
mov eax, dword [0x41cf34]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408f34
cmp dword [0x41cf38], ecx
je 0x408f34
push eax
call esi
push dword [0x41cf38]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408f34
test ebx, ebx
je 0x408f34
call edi
test eax, eax
je 0x408f2b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408f2b
test byte [ebp - 8], 1
jne 0x408f34
or dword [ebp + 0x10], 0x200000
jmp 0x408f67
mov eax, dword [0x41cf2c]
cmp eax, dword [ebp - 0x18]
je 0x408f67
push eax
call esi
test eax, eax
je 0x408f67
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408f67
mov eax, dword [0x41cf30]
cmp eax, dword [ebp - 0x18]
je 0x408f67
push eax
call esi
test eax, eax
je 0x408f67
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41cf28]
call esi
test eax, eax
je 0x408f83
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408f85
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040248e
leave
ret
Function at 0x40de30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [esi + 0x2c]
mov dword [ebp - 0xc], edi
jmp 0x40de43
mov edi, dword [ebp - 0xc]
mov ebx, dword [esi + 0x3c]
sub ebx, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub ebx, eax
lea edx, [edi + ecx - 0x106]
mov dword [ebp - 4], ebx
cmp eax, edx
jb 0x40debd
mov eax, dword [esi + 0x38]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.00402dd0
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], edi
sub dword [esi + 0x6c], edi
add esp, 0xc
sub dword [esi + 0x5c], edi
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x40de91
sub eax, edi
jmp 0x40de93
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x40de82
mov ecx, dword [esi + 0x40]
mov edx, edi
lea ecx, [ecx + edi*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x40deb0
sub eax, edi
jmp 0x40deb2
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x40dea1
add ebx, edi
mov dword [ebp - 4], ebx
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x40df6f
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 4]
mov ebx, ecx
mov dword [ebp - 8], eax
cmp ebx, edx
jbe 0x40dee3
mov ebx, edx
test ebx, ebx
je 0x40df33
mov edx, dword [edi + 0x1c]
sub ecx, ebx
mov dword [edi + 4], ecx
mov ecx, dword [edx + 0x18]
cmp ecx, 1
jne 0x40df06
mov eax, dword [edi]
mov ecx, dword [edi + 0x30]
push ebx
push eax
push ecx
call fcn.00410750
jmp 0x40df18
cmp ecx, 2
jne 0x40df21
mov edx, dword [edi]
mov eax, dword [edi + 0x30]
push ebx
push edx
push eax
call fcn.00410730
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 8]
add esp, 0xc
mov ecx, dword [edi]
push ebx
push ecx
push eax
call fcn.00402dd0
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x40df5b
mov edx, dword [esi + 0x6c]
add edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x40df6f
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x40de40
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407740
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
push ebx
push esi
push edi
push 0x21
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0xaf]
mov byte [ebp - 0xb0], bl
mov dword [ebp - 0x14], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
push eax
push dword [0x4017e8]
call fcn.00405274
xor eax, eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0x28], bl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x27]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
pop ecx
pop ecx
stosb byte es:[edi], al
lea eax, [ebp - 0x28]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push ebx
push ebx
lea eax, [ebp - 0x28]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_OpenFile]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
push 0x10
mov dword [ebp - 0x10], 0xc
lea edi, [eax + 0x74c]
lea eax, [ebp - 0xb0]
push eax
mov dword [ebp - 8], ebx
push edi
call esi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x4077f2
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0xb0]
push 0x10
push eax
push edi
jmp 0x4077d4
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push dword [0x4017f4]
lea eax, [ebp - 0x10]
push ebx
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, ebx
mov dword [ebp + 8], eax
jne 0x407818
call esi
jmp 0x407855
push ebx
push 0x493e0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
cmp eax, 0x102
jne 0x407837
push edi
call fcn.00405842
pop ecx
jmp 0x407818
cmp eax, 0xffffffff
je 0x407818
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x69f1c3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x69441c], 1
jne 0x69f351
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0069ebcf
add esp, 0xc
cmp edx, 0x2bc0
xor ecx, dword [esp + 0x10]
xor ecx, dword [esp + 0x10]
jmp 0x69f1f9
cmp esi, dword [esp]
js 0x69f21b
pushf
lea edx, [edx + 0x7362]
lea edx, [edx - 0x7362]
xor esi, 0
and esp, 0xffffffff
test edi, edx
popf
jge 0x69f218
jns 0x69f21b
call 0x495237e5
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
jg 0x69f24d
nop
nop
jbe 0x69f270
pushf
xchg esi, edi
xchg esi, edi
jnp 0x69f259
rol ecx, 2
rol ecx, 0x1e
popf
lea edx, [edx + 0x7a42]
lea edx, [edx - 0x7a42]
ja 0x69f270
call 0x81523ffe
jmp 0xe8b77a7a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.006baff8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x69f2e5
xor eax, eax
jmp 0x69f3bf
lea edx, [edx]
jae 0x69f2e9
jge 0x69f2fe
pushf
jbe 0x69f2ef
xor edi, 0
jle 0x69f2f4
popf
jb 0x69f2f8
nop
jmp 0x69f2fb
jl 0x69f2fe
mov ebp, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.006a4075
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0069ebcf
add esp, 0xc
test ecx, 0x790a
and ebx, ebx
jbe 0x69f33b
pushf
stc
mov ebx, ebx
shr edx, 0
popf
jp 0x69f334
xchg edx, edx
jle 0x69f338
ja 0x69f33b
call 0x16270c2
cmp dword [ebp - 8], 0
je 0x69f34b
mov eax, dword [ebp - 8]
mov dword [0x69441c], eax
jmp 0x69f34f
xor eax, eax
jmp 0x69f3bf
jmp 0x69f35a
mov ecx, dword [0x69441c]
mov dword [ebp - 8], ecx
xor esp, 0
rol edi, 2
ror edi, 2
xor ecx, dword [esp + 4]
xor ecx, dword [esp + 4]
nop
jle 0x69f389
pushf
lea esp, [esp]
cmp ebx, 0x3b7d
test dword [esp + 0x10], ecx
xchg ebx, ebx
popf
jg 0x69f383
jo 0x69f385
nop
jg 0x69f389
mov ebx, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
push ebx
add ebx, 0x3dd3
ror ebx, 9
pop ebx
cmp edi, eax
je 0x69f3a8
xchg esp, esp
lea esp, [esp]
mov edx, edx
jne 0x69f3a8
jmp 0x51663937
mov eax, dword [ebp - 4]
push eax
call fcn.006ab3b1
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x69f3c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0069ebcf
add esp, 0xc
mov eax, eax
xchg ebx, ebx
nop
jbe 0x69f3f4
lea esp, [esp]
nop
xchg ebx, edx
xchg ebx, edx
ja 0x69f3f4
add eax, 0xec45c677
jp 0x69f3bf
mov byte [ebp - 0x14], 0x7a
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0x13], 0x74
inc ebp
call 0xe9afba47
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xf], 0x4a
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xd], 0x67
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x16], 0x75
mov byte [ebp - 0xc], 0x70
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0xe], 0x6f
ja 0x69f42e
cmc
ror esi, 0
test dword [esp + 4], eax
jg 0x69f43f
xchg esi, esi
jb 0x69f43c
jle 0x69f43f
lcall 0x1e9, 0x80f44d8a
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0x17]
sub al, 1
mov byte [ebp - 0x17], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
lea esp, [esp]
jmp 0x69f4b5
jb 0x69f4cf
jno 0x69f4b9
lea ebx, [ebx]
xchg edx, ebx
xchg edx, ebx
lea esi, [esi + 0x7f7c]
lea esi, [esi - 0x7f7c]
jae 0x69f4cf
sub eax, 0xbb24e89a
add dword [eax], eax
call fcn.006baff8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x69f4e2
jmp 0x69f576
cld
je 0x69f4f8
lea edx, [edx + 0x7794]
lea edx, [edx - 0x7794]
jno 0x69f4f3
jbe 0x69f4f5
jne 0x69f4f8
mov esp, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.006a4075
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0069ebcf
add esp, 0xc
or eax, 0
jle 0x69f524
lea edx, [edx]
mov esp, esp
jg 0x69f524
xor eax, 0xfc7d83
cmp dword [ebp - 4], 0
jne 0x69f52c
jmp 0x69f576
cmp esi, edx
or esp, 0
xor esp, 0
je 0x69f540
je 0x69f538
lea esp, [esp]
jmp 0x69f53d
jne 0x69f540
mov edx, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.006ab3b1
add esp, 4
xor edx, 0
ror esp, 0
xor ecx, 0x3cea
xor ecx, 0x3cea
jl 0x69f56f
xchg edx, edx
jge 0x69f564
xchg edi, edx
xchg edi, edx
xchg edi, eax
xchg edi, eax
jge 0x69f56f
mov ecx, 0x458bd8ca
or byte [eax - 1], dl
push ebp
cld
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x69f57f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.0069ebcf
add esp, 0xc
lea esi, [esi + 0x6021]
lea esi, [esi - 0x6021]
nop
jg 0x69f5a7
neg eax
neg eax
jno 0x69f5b7
je 0x69f5af
jno 0x69f5b1
jne 0x69f5b3
jo 0x69f5b7
mov ebp, 0xec45c641
inc edi
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
push edi
pop edi
nop
jle 0x69f5ec
jns 0x69f5f6
lea esp, [esp]
jo 0x69f5f3
js 0x69f5f6
mov esi, 0x80ec4d8a
jmp 0xecb77e00
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
ror esi, 0x1e
ror esi, 2
sub esp, 0
jne 0x69f666
jge 0x69f663
je 0x69f666
sub eax, 0x1b98d
call fcn.006baff8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x69f67b
xor eax, eax
jmp 0x69f70c
jnp 0x69f67d
or esi, esi
std
cld
jg 0x69f68a
js 0x69f685
js 0x69f687
jle 0x69f68a
call 0x51563c1b
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.006a4075
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.0069ebcf
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x69f6f8
clc
mov edi, edi
sub eax, 0
js 0x69f6cf
mov esp, esp
xchg ecx, edx
xchg ecx, edx
lea ebx, [ebx + 0x34e8]
lea ebx, [ebx - 0x34e8]
jns 0x69f6cf
mov esi, 0x458b459a
cld
mov eax, dword [ebp - 4]
push eax
call fcn.006ab3b1
add esp, 4
jno 0x69f6dd
or esp, 0
push ebx
pop ebx
ja 0x69f6ef
je 0x69f6e6
nop
xchg ecx, edi
xchg ecx, edi
jbe 0x69f6ef
mov esi, 0x84d8ba2
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x69f70c
mov eax, eax
jge 0x69f6fc
shl esp, 0
inc ebx
dec ebx
jnp 0x69f70a
jbe 0x69f705
mov eax, eax
jp 0x69f70a
xor eax, 0x5e5fc033
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x6a07ef
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
cmp dword [ebp + 8], 0
jne 0x6a0803
jmp 0x6a0992
rol esp, 0
shr esp, 0
xchg edi, ebx
xchg edi, ebx
jnp 0x6a0819
jge 0x6a0811
jmp 0x6a0813
js 0x6a0815
jp 0x6a0819
add eax, 0x8458be1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [0x695694], edx
std
cld
call fcn.006a0831
Function at 0x6a206e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0069ebcf
add esp, 0xc
lea esi, [esi + 0x61b0]
lea esi, [esi - 0x61b0]
jne 0x6a20a8
pushf
jg 0x6a2099
xor ecx, dword [esp]
xor ecx, dword [esp]
jmp 0x6a20a1
popf
mov eax, eax
je 0x6a20a8
xor eax, 0x44e845c6
mov byte [ebp - 0x18], 0x44
mov byte [ebp - 0x13], 0x54
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 9], 0x65
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0xd], 0x66
mov byte [ebp - 8], 0x6d
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 7], 0x66
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x10], 0x77
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 6], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xa], 0x6f
jle 0x6a20f6
xor ebx, 0x4ab5
xor ebx, 0x4ab5
jae 0x6a210b
jl 0x6a2106
jb 0x6a210b
mov eax, 0x4d8a6e79
call 0x886c0a92
dec ebp
call 0x815776a2
ljmp 0x458a
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 8]
sub dl, 1
mov byte [ebp - 8], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xc]
sub dl, 1
mov byte [ebp - 0xc], dl
mov al, byte [ebp - 7]
sub al, 1
mov byte [ebp - 7], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
lea esi, [esi + 0x6d0b]
lea esi, [esi - 0x6d0b]
ror edi, 0xb
ror edi, 0x15
jo 0x6a21c1
jae 0x6a21bd
nop
jno 0x6a21c1
lcall 0x8900, 0x1082ce8
inc ebp
cld
call 0x6b29f2
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x6a21d6
xor eax, eax
jmp 0x6a2289
and ebx, 0xffffffff
xor edx, dword [esp + 0xc]
xor edx, dword [esp + 0xc]
cld
shl esi, 0
ja 0x6a21f7
lea eax, [eax + 0x4f89]
lea eax, [eax - 0x4f89]
jbe 0x6a21f7
mov ecx, 0xe84d8dc3
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.006a4075
mov dword [ebp - 0x1c], eax
push 0x13
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0069ebcf
add esp, 0xc
cmp dword [ebp - 0x1c], 0
jne 0x6a2221
xor eax, eax
jmp 0x6a2289
call fcn.006a2226
Function at 0x6a32fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 8], 0
push 0xe
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0069ebcf
add esp, 0xc
lea ebx, [ebx + 0x7322]
lea ebx, [ebx - 0x7322]
and ebx, 0xffffffff
jp 0x6a335b
pushf
push ebx
add ebx, 0x3b1a
ror ebx, 0x19
pop ebx
sub edx, 0
ror esi, 0xd
ror esi, 0x13
shr esi, 0
popf
lea eax, [eax + 0x6ca8]
lea eax, [eax - 0x6ca8]
jns 0x6a3356
jae 0x6a3358
jnp 0x6a335b
mov esp, 0x51e845c6
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x34
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x33
mov byte [ebp - 0xb], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0xf], 0x4f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0x14]
sub al, 1
mov byte [ebp - 0x14], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
nop
add edi, 0x1ca1
sub edi, 0x1ca1
jae 0x6a3413
test edx, ebx
jno 0x6a3429
pushf
ror ebx, 6
ror ebx, 0x1a
popf
jge 0x6a3423
xchg esp, esp
nop
jo 0x6a3429
mov edx, 0x17bcae8
add byte [ecx + 0x7d83f845], cl
clc
add byte [ebp + 7], dh
call fcn.006baff8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x6a343e
xor eax, eax
jmp 0x6a34d3
rol esp, 0
jno 0x6a3443
jno 0x6a3452
pushf
inc eax
dec eax
popf
jp 0x6a344d
mov esi, esi
jo 0x6a3452
add eax, 0x52e8558d
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.006a4075
mov dword [ebp - 4], eax
push 0xe
push 0
lea ecx, [ebp - 0x18]
push ecx
call fcn.0069ebcf
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x6a347c
xor eax, eax
jmp 0x6a34d3
or ecx, 0
xchg ebx, edx
xchg ebx, edx
xor esp, 0
je 0x6a349a
pushf
or esp, 0
or ebx, ebx
popf
jo 0x6a3493
ja 0x6a3495
lea ecx, [ecx]
jne 0x6a349a
mov esp, 0x52fc558b
mov edx, dword [ebp - 4]
push edx
call fcn.006ab3b1
add esp, 4
rol eax, 1
rol eax, 0x1f
clc
std
cld
cmp esp, 0x5632
jl 0x6a34c8
pushf
add esp, 0
nop
shl edi, 0
popf
jb 0x6a34c3
mov ecx, ecx
jge 0x6a34c8
sub eax, 0x500c458b
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x6a42b2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.0069ebcf
add esp, 0xc
push 0x21
push 0x695e2c
lea ecx, [ebp - 0x138]
push ecx
call fcn.006ab37d
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x6a43ba
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.0069ebcf
add esp, 0xc
push 0xb
push 0x695e50
lea edx, [ebp - 0x138]
push edx
call fcn.006ab37d
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x6a43ad
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.006ab37d
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x6a43bc
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x6a5a9f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.0069ebcf
add esp, 0xc
shr esp, 0
xchg esi, eax
xchg esi, eax
rol edx, 8
ror edx, 8
jne 0x6a5ad5
jp 0x6a5ace
jb 0x6a5ad0
jl 0x6a5ad2
je 0x6a5ad5
mov esp, 0x4ef045c6
mov byte [ebp - 0x10], 0x4e
mov byte [ebp - 0xb], 0x68
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0xa], 0x66
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 9], 0x43
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 8], 0x70
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x42
mov byte [ebp - 5], 0
xor edx, ecx
xor edx, ecx
nop
xor eax, 0x48b6
xor eax, 0x48b6
cmp esi, dword [esp + 4]
jae 0x6a5b3b
pushf
call fcn.006a5b21