joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10bb8020
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10bb802a
pushal
call 0x10bb8030
pop ebp
sub ebp, 0x10
sub ebp, 0xbb8020
mov al, byte [esp + 0x28]
cmp al, 1
je 0x10bb8054
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x10bb805d
mov eax, 0xbb8020
add eax, ebp
add eax, 0x63
mov ecx, 0x5cd
mov edx, 0x66e5fb33
xor byte [eax], dl
inc eax
dec ecx
jne 0x10bb8074
jmp 0x10bb8087
mov eax, 0xfbab8fe
xor esi, dword [ebx]
xor esi, dword [edx + 0x3333cbf2]
xor esi, dword [eax]
dec byte [ebx + 0x33333335]
mov dword [ebx], ebx
xor esi, dword [ebx]
xor eax, esp
sal dword [eax], 1
sti
mov eax, 0x33333fb2
xor esi, dword [eax]
mul byte [ebx - 0x42]
push edi
pop ss
iretd

Function at 0x9301cc
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x9301d2
pop ebp
sub ebp, 6
sub ebp, 0x5301cc
jmp 0x930230
jmp 0x930239
mov eax, 0x5301cc
add eax, ebp
add eax, 0x93
mov ecx, 0x642
mov edx, 0x46ac6c92
xor byte [eax], dl
inc eax
dec ecx
jne 0x930250
jmp 0x930263
clc
sar dl, cl
xchg edx, eax
adc byte [edx + 0x5e92fa92], 0xbe
xchg edx, eax
adc esp, dword [edx + 0x28]
pop ebp
and bh, ah
adc esp, dword [edx + 0x28]
pop ebp
and bh, ah
mov eax, dword [0x76dc252]
ljmp 0x5f19
Function at 0x4066f7
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x25c
push ebx
mov ebx, dword [esp + 0x268]
push esi
mov esi, dword [esp + 0x268]
push edi
mov edi, ebx
push esi
and edi, 4
call fcn.00406616
mov dword [esp + 0x14], eax
test bl, 8
je 0x406739
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x7a8608], eax
jmp 0x4068b8
push ebp
mov ebp, ebx
and ebp, 1
mov dword [esp + 0x14], ebp
je 0x406756
test eax, eax
je 0x4068a7
test bl, 2
je 0x406870
push esi
push 0x7a3a88
call fcn.00406af8
test ebp, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x406779
push str..
push 0x7a3a88
call ebp
jmp 0x40677f
push esi
call fcn.00406cee
xor eax, eax
cmp word [esi], ax
jne 0x406790
cmp word [0x7a3a88], 0x5c
jne 0x406798
push 0x4082b0
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
push 0x7a3a88
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x406859
push 0x2e
pop eax
cmp word [esp + 0x48], ax
jne 0x4067e2
cmp word [esp + 0x4a], 0
je 0x40683b
cmp word [esp + 0x4a], ax
jne 0x4067e2
cmp word [esp + 0x4c], 0
je 0x40683b
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x14]
call fcn.00406af8
test byte [esp + 0x1c], 0x10
je 0x406809
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x40683b
push ebx
push esi
call fcn.004066f7
jmp 0x40683b
push edi
push esi
call fcn.00406563
test eax, eax
jne 0x406833
test edi, edi
je 0x40682b
push esi
push 0xfffffffffffffff1
call fcn.00405d18
xor eax, eax
push eax
push esi
call fcn.0040621b
jmp 0x40683b
inc dword [0x7a8608]
jmp 0x40683b
push esi
push 0xfffffffffffffff2
call fcn.00405d18
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4067c4
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x14], 0
je 0x4068b7
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov word [eax - 2], cx
cmp dword [esp + 0x18], ecx
je 0x4068a7
push esi
call fcn.004065ad
test eax, eax
je 0x4068b7
push esi
call fcn.00406534
mov eax, edi
or eax, 1
push eax
push esi
call fcn.00406563
test eax, eax
jne 0x4068af
test edi, edi
je 0x4068a7
push esi
push 0xfffffffffffffff1
call fcn.00405d18
xor eax, eax
push eax
push esi
call fcn.0040621b
jmp 0x4068b7
inc dword [0x7a8608]
jmp 0x4068b7
push esi
push 0xffffffffffffffe5
call fcn.00405d18
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x25c
ret 8

Function at 0x4068f9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x56a34c], 1
mov dword [0x56a350], 1
mov dword [0x56a354], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret

Function at 0x4b2b10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov eax, 0x1007c
push edi
push esi
push ebx
call fcn.00528d28
xor edx, edx
xor ecx, ecx
sub esp, eax
mov eax, dword [esp + 0x10090]
mov word [esp + 0x70], dx
lea edi, [esp + 0x20]
mov word [esp + 0x20], cx
movzx eax, byte [eax]
test al, al
je 0x4b2bc7
xor ebp, ebp
lea edi, [esp + 0x20]
lea esi, [esi]
mov byte [esp + 0x1a], al
lea eax, [esp + 0x1a]
mov esi, 0x28
lea ebx, [edi + ebp*2]
mov dword [esp + 4], eax
lea eax, [esp + 0x1c]
sub esi, ebp
mov dword [esp + 8], 2
mov dword [esp], eax
mov byte [esp + 0x1b], 0
call sub.msvcrt.dll_mbstowcs
cmp eax, 1
jne 0x538302
cmp word [edi + ebp*2], 0
movzx eax, word [esp + 0x1c]
je 0x4b2ba4
lea esi, [esi]
add ebx, 2
sub esi, 1
cmp word [ebx], 0
jne 0x4b2b98
test esi, esi
je 0x538302
mov word [ebx], ax
xor eax, eax
add ebp, 1
mov word [ebx + 2], ax
mov eax, dword [esp + 0x10090]
movzx eax, byte [eax + ebp]
test al, al
jne 0x4b2b50
lea ebx, [esp + 0x70]
mov dword [esp + 8], 0x10000
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea edx, [eax - 1]
sub esp, 0xc
xor eax, eax
cmp edx, 0xffff
ja 0x4b2bf8
mov dword [esp], ebx
call sub.msvcrt.dll__wcsdup
add esp, 0x1007c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4b2c10
Capabilities:
Set environment variable

Disassembly:
push ebp
xor edx, edx
push edi
push esi
push ebx
sub esp, 0x7c
mov eax, dword [esp + 0x90]
mov word [esp + 0x20], dx
lea edi, [esp + 0x20]
movzx eax, byte [eax]
test al, al
je 0x4b2cb7
xor ebp, ebp
lea edi, [esp + 0x20]
lea esi, [esi]
mov byte [esp + 0x1a], al
lea eax, [esp + 0x1a]
mov esi, 0x28
lea ebx, [edi + ebp*2]
mov dword [esp + 4], eax
lea eax, [esp + 0x1c]
sub esi, ebp
mov dword [esp + 8], 2
mov dword [esp], eax
mov byte [esp + 0x1b], 0
call sub.msvcrt.dll_mbstowcs
cmp eax, 1
jne 0x538307
cmp word [edi + ebp*2], 0
movzx eax, word [esp + 0x1c]
je 0x4b2c94
lea esi, [esi]
add ebx, 2
sub esi, 1
cmp word [ebx], 0
jne 0x4b2c88
test esi, esi
je 0x538307
mov word [ebx], ax
xor eax, eax
add ebp, 1
mov word [ebx + 2], ax
mov eax, dword [esp + 0x90]
movzx eax, byte [eax + ebp]
test al, al
jne 0x4b2c40
mov eax, dword [esp + 0x94]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
sub esp, 8
add esp, 0x7c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5261e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp byte [0x569951], 0
mov eax, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
mov dword [esp + 0x1c], eax
je 0x526268
mov dword [esp + 4], 0x545a9e
mov dword [esp], esi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x5262e0
mov ebx, dword [0x5698a0]
jmp 0x526224
lea ebx, [eax + ecx + 4]
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_strcmp
mov dword [esp], ebx
mov edi, eax
call sub.msvcrt.dll_strlen
lea eax, [ebx + eax + 1]
mov ecx, dword [eax]
test edi, edi
jne 0x526220
lea ecx, [eax + 6]
movzx eax, word [eax + 4]
mov edx, ebp
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x1c]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00516f80
mov dword [esp + 8], 0xa
mov dword [esp + 4], 3
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [eax + 4]
sub esp, 4
mov dword [0x5698a0], eax
add eax, 8
mov ebx, dword [eax - 8]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], 0
mov dword [0x5698a0], eax
call fcn.00525730
cmp eax, ebx
jne 0x526337
mov byte [0x569951], 1
jmp 0x526200
cmp byte [0x569950], 0
jne 0x526218
mov ebx, dword [sym.imp.python312.dll_PyDict_New]
call ebx
mov dword [0x56a154], eax
call ebx
mov dword [0x56a150], eax
call ebx
mov dword [0x56a14c], eax
call ebx
mov dword [0x56a148], eax
call ebx
mov dword [0x56a144], eax
call ebx
mov dword [0x56a140], eax
call ebx
mov dword [0x56a13c], eax
call ebx
mov byte [0x569950], 1
mov dword [0x56a138], eax
jmp 0x526218
mov dword [esp], str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort
lea esi, [esi]
nop

Function at 0x527d78
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call fcn.00537738
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call fcn.00537738
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort

Function at 0x52894c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x52896b
mov eax, 0
jmp 0x5289af
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x52898e
mov eax, 0
jmp 0x5289af
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x5289aa
mov eax, 0
jmp 0x5289af
mov eax, 1
leave
ret
Function at 0x5289b1
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x528a10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x528a08
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x528a08
mov eax, dword [ebp - 4]
jmp 0x528a24
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x5289e5
mov eax, 0
leave
ret
Function at 0x408b84
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4190cc]
jne 0x408b8e
repz ret
jmp fcn.0040a6e6

Function at 0x413000
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
push ebx
push esi
push edi
mov ebx, edx
mov ecx, dword [esp + 0x10]
lea edi, [0x41a0c0]
or ebx, ecx
mov esi, edx
test ebx, 3
mov ebx, dword [edi]
jne 0x413080
add edx, ecx
shr ecx, 2
neg ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor eax, dword [edx + ecx*4]
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
xor eax, dword [edi + ebx*4]
inc ecx
jne 0x413040
pop edi
pop esi
pop ebx
ret 4
and esi, 3
je 0x41309d
mov bl, al
shr eax, 8
xor bl, byte [edx]
inc edx
xor eax, dword [ebx*4 + 0x41a0c0]
dec edi
je 0x4130e3
dec esi
jne 0x413088
mov esi, ecx
shr ecx, 2
je 0x4130cd
xor eax, dword [edx]
mov bl, al
shr eax, 8
inc edx
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
inc edx
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
inc edx
xor eax, dword [edi + ebx*4]
mov bl, al
shr eax, 8
inc edx
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4130a4
and esi, 3
je 0x4130e3
mov bl, al
shr eax, 8
xor bl, byte [edx]
inc edx
xor eax, dword [edi + ebx*4]
dec esi
jne 0x4130d5
pop edi
pop esi
pop ebx
ret 4

Function at 0x413100
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1014
push ebp
mov ebp, esp
call 0x40e4f5
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
or eax, 0xffffffff
mov dword [0x415c84], 9
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
mov dword [ebp - 8], eax
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
mov ecx, 0x1000
xor eax, eax
lea edx, [ebp - 0x1010]
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
mov edi, eax
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
test eax, eax
mov esi, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100029e9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x18]
push edi
push esi
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jle 0x10002a1e
and eax, 0xffff
or eax, 0x80070000
test eax, eax
js 0x10002a57
mov edx, dword [ebp - 4]
test edi, edi
jne 0x10002a2b
test esi, esi
jmp 0x10002a45
test esi, esi
je 0x10002a4e
cmp edx, 1
je 0x10002a39
cmp edx, 2
jne 0x10002a4e
mov ecx, dword [edi]
cmp ecx, 2
jb 0x10002a47
cmp word [ecx + esi - 2], bx
je 0x10002a4e
mov eax, 0x8000ffff
jmp 0x10002a57
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10002a57
mov dword [ecx], edx
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x100059ca
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.10004609
add esp, 0xc
mov dword [ebp - 0x6c8], eax
push 0
lea eax, [ebp - 0x6e0]
push eax
push dword [ebp - 0x378]
push dword [ebp - 4]
push dword [ebp - 0x66c]
call dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], eax
push dword [ebp - 0x66c]
call dword [ebp - 0x680]
cmp dword [ebp - 0x6cc], 0
je 0x100067d7
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.100045b5
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x10005a51
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x10005a9a
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
mov esi, 0xc133dc4d
ror dword [ebx - 0x6ff73], 0xff
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x10005a44
call fcn.10004644
jae 0x10005a6d
pop ebx
or dword [eax - 0x72b5b], eax
inc dword [eax]
and byte [ebp - 0x72b], 0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10005ab1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
invalid
invalid
Function at 0x10006c5d
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push ebx
mov ebx, 0xbb40e64e
cmp dword [0x10001a44], eax
je 0x10006c7f
cmp dword [0x10001a44], ebx
jne 0x10006d18
push esi
push eax
push eax
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
xor esi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x10001a44
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x10001a44], esi
test esi, esi
jne 0x10006cee
mov dword [0x10001a44], ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
mov esi, 0x10001a44
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 4
push esi
call sub.KERNEL32.dll_WerRegisterMemoryBlock
mov eax, dword [0x10001a44]
not eax
mov dword [0x100094f0], eax
pop esi
pop ebx
leave
ret

Function at 0x10006d1b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10001a44]
jne fcn.10007a7b
ret

Function at 0x10006fca
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x10001434
push 0x80000000
mov dword [ebp - 8], ebx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10007068
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push dword [ebp - 8]
call esi
test eax, eax
jne 0x1000705e
push 4
pop esi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 0x10001a84
push dword [ebp - 4]
mov dword [ebp + 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000705e
cmp dword [ebp + 8], esi
jne 0x1000705e
mov esi, dword [ebp - 0xc]
cmp esi, 3
ja 0x1000705e
cmp dword [ebp - 4], ebx
je 0x10007050
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], ebx
je 0x1000705a
push dword [ebp - 8]
call edi
mov eax, esi
jmp 0x10007074
cmp dword [ebp - 4], ebx
je 0x10007068
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], ebx
je 0x10007072
push dword [ebp - 8]
call edi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100073f5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x100095cc], 0
je 0x1000740a
mov eax, dword [0x100095d0]
leave
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x10001b68
push 0x80000001
mov dword [ebp - 4], esi
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10007481
lea eax, [ebp - 8]
push eax
push 0x100095d0
push esi
push esi
push dword [0x100094f4]
mov dword [ebp - 8], 4
push dword [ebp - 4]
call edi
test eax, eax
jne 0x10007481
cmp dword [ebp - 8], 4
jne 0x10007481
mov esi, dword [0x100095d0]
mov byte [0x100095cc], 1
cmp dword [ebp - 4], eax
je 0x1000747a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1000750c
mov eax, dword [ebp - 4]
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x10007494
push eax
call esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x10001bb4
push 0x80000001
call ebx
test eax, eax
jne 0x100074f1
push 4
pop ebx
lea eax, [ebp - 8]
push eax
push 0x100095d0
push 0
push 0
push dword [0x100094f4]
mov dword [ebp - 8], ebx
push dword [ebp - 4]
call edi
test eax, eax
jne 0x100074f1
cmp dword [ebp - 8], ebx
jne 0x100074f1
mov edi, dword [0x100095d0]
mov byte [0x100095cc], 1
cmp dword [ebp - 4], eax
je 0x100074ed
push dword [ebp - 4]
call esi
mov eax, edi
jmp 0x1000750c
and dword [0x100095d0], 0
cmp dword [ebp - 4], 0
mov byte [0x100095cc], 1
je 0x1000750a
push dword [ebp - 4]
call esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10007a7b
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x100096e0], eax
mov dword [0x100096dc], ecx
mov dword [0x100096d8], edx
mov dword [0x100096d4], ebx
mov dword [0x100096d0], esi
mov dword [0x100096cc], edi
mov word [0x100096f8], ss
mov word [0x100096ec], cs
mov word [0x100096c8], ds
mov word [0x100096c4], es
mov word [0x100096c0], fs
mov word [0x100096bc], gs
pushfd
pop dword [0x100096f0]
mov eax, dword [ebp]
mov dword [0x100096e4], eax
mov eax, dword [ebp + 4]
mov dword [0x100096e8], eax
lea eax, [ebp + 8]
mov dword [0x100096f4], eax
mov eax, dword [ebp - 0x320]
mov dword [0x10009630], 0x10001
mov eax, dword [0x100096e8]
mov dword [0x100095e4], eax
mov dword [0x100095d8], 0xc0000409
mov dword [0x100095dc], 1
mov eax, dword [0x10001a44]
mov dword [ebp - 0x328], eax
mov eax, dword [0x100094f0]
mov dword [ebp - 0x324], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x10009628], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x10001c64
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x10009628], 0
jne 0x10007b67
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
leave
ret