joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5909e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6003a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [esp + 0x30]
xor ebx, ebx
push edi
mov dword [esp + 0x10], ebx
mov ecx, dword [esi]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x14], ebx
call fcn.005932b0
mov eax, dword [esp + 0x14]
dec eax
add esp, 8
cmp eax, 0xa
ja case.0x590a2e.2
movzx edx, byte [eax + 0x590c28]
jmp dword [edx*4 + 0x590c10]
mov ecx, dword [esi]
lea eax, [esp + 0xc]
push eax
push 0x63a9fc
push ecx
mov dword [esp + 0x18], ebx
call fcn.00593960
mov edx, dword [esp + 0x18]
push 0x63b304
push edx
call fcn.00583830
add esp, 0x14
test al, al
jne case.0x590a2e.4
mov esi, dword [esp + 0x30]
push esi
call fcn.005923a0
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov ecx, dword [esi]
lea eax, [esp + 0xc]
push eax
push 0x63a980
push ecx
mov dword [esp + 0x18], ebx
call fcn.00593960
mov edi, dword [esp + 0x3c]
mov esi, dword [esp + 0x18]
push edi
call fcn.005923a0
add esp, 0x10
cmp esi, ebx
je 0x590ae1
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x590ab2
sub eax, edx
push ebx
sar eax, 1
push eax
push esi
push edi
call fcn.005924a0
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
push ebx
xor eax, eax
push eax
push esi
push edi
call fcn.005924a0
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
push esi
mov esi, dword [esp + 0x34]
push esi
call fcn.0058ff80
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
push esi
mov esi, dword [esp + 0x34]
push esi
call fcn.00590840
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
push ebx
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.0058ede0
mov eax, dword [eax]
mov dword [esp + 0x28], ebx
cmp eax, ebx
je 0x590b63
add eax, 8
jmp 0x590b68
mov eax, 0x6a5586
push ebx
push eax
lea ecx, [esp + 0x1c]
call fcn.0058f440
mov ecx, eax
mov byte [esp + 0x28], 1
call fcn.0058f4e0
mov edi, dword [esp + 0x30]
push edi
mov esi, eax
call fcn.005923a0
add esp, 4
cmp esi, ebx
je 0x590ba8
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x590b97
sub eax, edx
sar eax, 1
jmp 0x590baa
xor eax, eax
push ebx
push eax
push esi
push edi
call fcn.005924a0
mov eax, dword [esp + 0x24]
push eax
call fcn.005da267
mov eax, dword [esp + 0x24]
add esp, 0x14
cmp eax, ebx
je 0x590bfb
dec dword [eax]
cmp dword [eax], ebx
jne 0x590bfb
mov ecx, dword [esp + 0x10]
push ecx
call fcn.005db659
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov edi, dword [esp + 0x30]
push edi
mov ecx, esi
call fcn.00579a70
mov ecx, dword [esp + 0x20]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x5ad10b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, dword [ebp + 8]
test dword [esi + 0x6c], 0x4000
jne 0x5ad12b
push 0x62f6c4
push esi
call fcn.005b490f
pop ecx
pop ecx
cmp dword [esi + 0x27c], 0
je 0x5ad26c
push ebx
push edi
push 0
push esi
call fcn.005b7231
push esi
call fcn.005b7158
add esp, 0xc
and dword [esi + 0x6c], 0xffff7fff
mov byte [ebp + 0xb], 0
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 9], 0x54
mov byte [ebp - 8], 0
mov byte [ebp - 0x1c], 0x66
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1a], 0x41
mov byte [ebp - 0x19], 0x54
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x13], 0x63
mov byte [ebp - 0x12], 0x54
mov byte [ebp - 0x11], 0x4c
mov byte [ebp - 0x10], 0
lea edi, [esi + 0x120]
push 4
lea eax, [ebp - 4]
push eax
push esi
call fcn.005b4731
lea eax, [ebp - 4]
push eax
push esi
call fcn.005b62b2
push esi
mov ebx, eax
call fcn.005b34a0
push 4
push edi
push esi
call fcn.005b62f1
mov eax, dword [edi]
add esp, 0x24
cmp eax, dword [ebp - 0xc]
jne 0x5ad1ee
cmp byte [ebp + 0xb], 0
jne 0x5ad1d8
cmp dword [esi + 0x27c], 1
jbe 0x5ad1e5
push 0x62f698
push esi
call fcn.005b490f
pop ecx
pop ecx
push ebx
push esi
call fcn.005b7231
jmp 0x5ad23c
cmp eax, dword [ebp - 0x14]
jne 0x5ad206
push ebx
push dword [ebp + 0xc]
push esi
call fcn.005b9331
add esp, 0xc
mov byte [ebp + 0xb], 1
jmp 0x5ad198
cmp eax, dword [ebp - 0x1c]
jne 0x5ad243
push ebx
push esi
call fcn.005b6622
cmp byte [ebp + 0xb], 0
pop ecx
pop ecx
jne 0x5ad228
cmp dword [esi + 0x27c], 1
jbe 0x5ad228
add ebx, 0xfffffffc
jmp 0x5ad1e5
test dword [esi + 0x6c], 0x8000
jne 0x5ad25d
push 0x62f66c
push esi
call fcn.005b490f
pop ecx
pop ecx
jmp 0x5ad198
push 0x62f63c
push esi
call fcn.005b4934
push ebx
push esi
call fcn.005b7231
add esp, 0x10
jmp 0x5ad198
add ebx, 0xfffffffc
or dword [esi + 0x6c], 4
pop edi
mov dword [esi + 0x110], ebx
pop ebx
pop esi
leave
ret
Function at 0x5af1d8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov cl, byte [eax + 8]
sub esp, 0x14
cmp cl, 3
je 0x5af35c
mov edx, dword [eax]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
mov dword [ebp + 8], edi
test cl, 2
je 0x5af228
movzx ecx, byte [eax + 9]
movzx edi, byte [esi]
mov ebx, ecx
sub ebx, edi
movzx edi, byte [esi + 1]
mov dword [ebp - 0x14], ebx
mov ebx, ecx
sub ebx, edi
movzx edi, byte [esi + 2]
sub ecx, edi
push 3
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
pop ebx
xor edi, edi
jmp 0x5af238
movzx ecx, byte [esi + 3]
movzx ebx, byte [eax + 9]
sub ebx, ecx
mov dword [ebp - 0x14], ebx
xor ebx, ebx
inc ebx
test byte [eax + 8], 4
je 0x5af24d
movzx ecx, byte [esi + 4]
movzx esi, byte [eax + 9]
sub esi, ecx
mov dword [ebp + ebx*4 - 0x14], esi
inc ebx
xor esi, esi
cmp ebx, edi
jle 0x5af359
lea ecx, [ebp + esi*4 - 0x14]
cmp dword [ecx], edi
jg 0x5af263
mov dword [ecx], edi
jmp 0x5af26a
mov dword [ebp + 8], 1
inc esi
cmp esi, ebx
jl 0x5af257
cmp word [ebp + 8], di
je 0x5af359
movzx ecx, byte [eax + 9]
dec ecx
dec ecx
je 0x5af342
dec ecx
dec ecx
je 0x5af313
sub ecx, 4
je 0x5af2f1
sub ecx, 8
jne 0x5af359
mov esi, dword [ebp + 0xc]
imul edx, ebx
mov dword [ebp - 4], edx
mov dword [ebp + 8], edi
cmp edx, edi
jbe 0x5af359
mov eax, dword [ebp + 8]
xor edx, edx
div ebx
movzx ax, byte [esi]
mov ecx, 0x100
imul ax, cx
lea edi, [esi + 1]
movzx cx, byte [edi]
add ax, cx
mov cx, word [ebp + edx*4 - 0x14]
shr ax, cl
movzx eax, ax
mov ecx, eax
shr ecx, 8
mov byte [esi], cl
mov esi, edi
mov byte [esi], al
inc esi
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jb 0x5af2af
jmp 0x5af359
mov esi, dword [ebp + 0xc]
imul edx, ebx
mov dword [ebp + 8], edx
cmp edx, edi
jbe 0x5af359
xor edx, edx
mov eax, edi
div ebx
mov cl, byte [ebp + edx*4 - 0x14]
shr byte [esi], cl
inc esi
inc edi
cmp edi, dword [ebp + 8]
jb 0x5af2fe
jmp 0x5af359
mov edi, dword [eax + 4]
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
mov edx, 0xf0
sar edx, cl
push 0xf
pop eax
sar eax, cl
and dl, 0xf0
or dl, al
test edi, edi
jbe 0x5af359
mov al, byte [esi]
mov cl, byte [ebp - 0x14]
shr al, cl
and al, dl
mov byte [esi], al
inc esi
dec edi
jne 0x5af331
jmp 0x5af359
mov eax, dword [eax + 4]
mov ecx, dword [ebp + 0xc]
cmp eax, edi
jbe 0x5af359
mov dl, byte [ecx]
shr dl, 1
and dl, 0x55
mov byte [ecx], dl
inc ecx
dec eax
jne 0x5af34c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5b2f76
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x5b2fa3
push esi
call fcn.005bd12c
cmp byte [esi + 0x40], 0
pop ecx
je 0x5b2f9c
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x5b3010
mov eax, dword [esi + 0x1a0]
cmp byte [eax + 0x10], 0
je 0x5b3005
mov eax, dword [esi + 8]
test eax, eax
je 0x5b2fc4
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x1a0]
push esi
call dword [eax]
pop ecx
test eax, eax
je 0x5b3001
cmp eax, 2
je 0x5b3005
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x5b2fb9
cmp eax, 3
je 0x5b2fe8
cmp eax, 1
jne 0x5b2fb9
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
jl 0x5b2fb9
mov ecx, dword [esi + 0x120]
add dword [eax + 8], ecx
jmp 0x5b2fb9
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
jmp 0x5b302e
cmp eax, 0xcc
je 0x5b302e
mov eax, dword [esi]
mov dword [eax + 0x14], 0x15
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.005b2e49
pop esi
ret

Function at 0x5b34fa
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
test eax, eax
je 0x5b352f
push edi
mov edi, 0x140
cmp dword [esp + 0x10], edi
jae 0x5b3522
push eax
call fcn.005b61d1
push 2
call fcn.005b61c0
pop ecx
pop ecx
mov dword [esi], eax
push edi
push 0
push eax
call fcn.005d97f0
add esp, 0xc
pop edi
pop esi
ret

Function at 0x5b5e16
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, dword [edi + 0x18]
push dword [esi + 0x1c]
push 0x1000
push 1
push dword [esi + 0x20]
call fcn.005d9e7c
add esp, 0x10
test eax, eax
ja 0x5b5e70
cmp byte [esi + 0x24], 0
je 0x5b5e4d
mov eax, dword [edi]
mov dword [eax + 0x14], 0x2b
mov eax, dword [edi]
push edi
call dword [eax]
pop ecx
mov eax, dword [edi]
mov dword [eax + 0x14], 0x7b
mov eax, dword [edi]
push 0xffffffffffffffff
push edi
call dword [eax + 4]
mov eax, dword [esi + 0x20]
pop ecx
mov byte [eax], 0xff
mov eax, dword [esi + 0x20]
pop ecx
push 2
mov byte [eax + 1], 0xd9
pop eax
mov ecx, dword [esi + 0x20]
mov dword [esi + 4], eax
pop edi
mov dword [esi], ecx
mov byte [esi + 0x24], 0
mov al, 1
pop esi
ret

Function at 0x6dd762
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], edi
pop edi
mov byte [ebp + eax - 0x100], dl
inc dword [ebp - 0x108]
jmp 0x6d3c22

Function at 0x6f20ab
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp], edx
pop edx
pop esi
rol eax, 5
mov dword [0x6d5380], eax

Function at 0x700b38
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], edi
call fcn.00756621
fild dword [ecx + 0x5d]
xchg ebx, eax
xor ecx, 0x7b36de09
pop ebx
call fcn.0052f76b
ja 0x700b44
cdq
mov al, 0x5a
jmp 0x75c16f
xchg dword [esp], eax
call fcn.0071ee31
stosd dword es:[edi], eax
salc
mov ah, cl
xor eax, ebp
jmp loc.006c9dc0
Function at 0x7091e3
Capabilities:
Packed with generic packer

Disassembly:
nop
pushal
jmp fcn.006e6563
mov dword [esp], edx
call fcn.0075461c
in al, dx
jno 0x709212
std
push ecx
rol ecx, 3
call fcn.006d27e2
loope 0x709240
inc esi
popal
jl 0x7091dc
push es
loopne 0x7091f8
sub eax, 0xfb2f7504
call fcn.006d72af
into
cmp dword [edx], edi
jmp 0x7091f9
add byte [eax], al
add byte [ebp + 0x73970e05], cl
add dh, al
add bl, al

Function at 0x70b20b
Capabilities:
Packed with generic packer

Disassembly:
jo 0x6d2a08
mov eax, dword [ebp - 8]
mov al, byte [eax]
and al, 1
jmp loc.006e7746
mov eax, dword [ebp - 8]
jmp 0x6dc0fc
call fcn.0070f94a
call fcn.0052f76b
cmpsd dword [esi], dword es:[edi]
test dword [eax - 0x4ff934fa], edi
cmpsb byte [esi], byte es:[edi]
mov edx, ebx
xchg dword [esp], edx
call fcn.006d72af
adc eax, 0x66dbf8dd
pop es
pushal
add cl, al
ret 0xe907
cmp dword [ebp - 0xc], 0
je 0x6c2b41
jmp 0x6fbeb0
jmp loc.006dc7d5
mov dword [esp], ecx
pop ecx
call fcn.006d8b82
jmp 0x754c2c
jmp 0x6e8a38

Function at 0x71c1c0
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [esp]
call fcn.006deb80
mov dword [esp], esi
call fcn.0070fba8
jmp 0x7382c8
xor edi, 0x6d4de308
cmp ecx, 0x3e12bdf0
jmp 0x76d6b5
ja 0x6cfec3
xor edi, esi
rol edi, 0x16
jmp loc.00530820
Function at 0x71e73b
Capabilities:
Packed with generic packer

Disassembly:
call fcn.007588c6
jmp 0x71272d
ror eax, 5
jmp 0x70b67a
jmp 0x73ca4a
xchg dword [esp], ebx
ret
mov dword [ebx], edx
pushfd
pop edi
je 0x6eeea3
add esp, 0xc
jmp 0x70f8ee
jle 0x6fc139
mov ch, 0x55
stc
push es
inc eax
aaa
xchg esi, ecx
call fcn.006d27e2
stosd dword es:[edi], eax
mov ebx, 0xce87a04b
call fcn.006f262b
int1
xor bl, byte [ecx - 0x80]
mov ebx, 0x5987c523
sub ecx, 0x45d06693
add ecx, 0xf3f24e3d
call fcn.006f02d8
xchg ecx, eax
add esi, dword [ecx + 0x276fe982]
push es
add byte [edi - 0x63afdbfc], al
push 0x172f629
pop eax
call fcn.006d72af
jge fcn.006fc0e4
pop eax
dec ecx
js 0x6fc0fd
push esp
and ebp, eax
pop eax
mov cl, 0xfd
call [eax]
das
wait
or eax, 0xe38dc90b
xor eax, 0x283628ee
jmp 0x6f2d8c
sub edx, 0xc978542c
mov eax, 0xcf0182f6
push edx
push 0x70c0fb50
pop edx
rol edx, 0x13
add edx, 0x25e9d73c
xchg dword [esp], edx
jmp loc.006cc854
xchg dword [esp], edi
pop edi
sbb edx, eax
jmp 0x738831
add eax, 0xf52a2d3b
jb 0x74853b
ror eax, 0x1f
add eax, 0x1e623644
xor eax, 0x42afc2d7
jmp 0x70d6f6
jmp 0x717ca3
jmp loc.006d3c1d
mov dword [ebx], edx
pushfd
pop edi
je 0x6eeea3
add esp, 0xc
pop edx
pop ecx
mov ebx, 0x6cf610
jmp 0x6fa27f
pop edx
pop ecx
mov ebx, 0x6cf610
xchg dword [esp], ebx
ret
mov dword [esp], ecx
call fcn.00756621
sub eax, 0x6804dce1
cli
and ebx, 0xffffffb2
pop edi
add edi, 0x4d926bf3
xchg dword [esp], edi
jmp 0x6fc105
je 0x703e87
jmp 0x76808e
xchg dword [esp], esi
call fcn.006d5798
jnp 0x71e75d
cmc
mov al, bl
push ecx
and esp, dword [ecx - 0x7edbcb79]
rcl eax, cl
cmp byte [ebx], 0xe9
adc dword [ebp - 3], esi
dec dword [edi]
test dword [ebx - 0x74fffb84], ecx
add eax, 0x6d5380
or eax, eax
jne 0x6f20b9
jmp 0x70d312
retf 0xd813
je 0x6fa290
jmp 0x74aeb0
call fcn.0073758a
pop es
mov dh, 0xe1
inc ebx
xchg dword [esp], eax
push esi
call fcn.006d0e84
mov dh, 0x2e
add ebp, edi
jmp 0x71e71d
jmp 0x763fd1
push 0x73b2b7
jmp 0x743bb7
jmp 0x70f6dc
ret
jmp 0x76bc5c
adc ebx, 0x674d38ba
xor esi, 0x212914e5
sub esi, ecx
jmp 0x703e81

Function at 0x7528e5
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov eax, dword [ebp - 0x24]
test byte [eax + 1], 0x80
jne 0x73e1d2
jmp loc.00758878
pop dword fs:[0]
add esp, 4
or eax, eax
jne 0x76279d
jmp 0x714aee
mov dword [eax], edx
jne 0x6d6af4
mov eax, dword [ebp - 0x24]
test byte [eax + 1], 0x80
jne 0x73e1d2
jmp 0x71ca89
pop dword fs:[0]
jmp loc.006c28a1
je 0x6f2a35
jmp loc.006d6c34
jmp loc.006d2a7e
mov eax, dword [ebp - 0x10]
mov edx, eax
call fcn.006d6e4a
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
jmp 0x7569e1
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
jmp 0x6e654b
mov dword [esp], eax
pop eax
call fcn.006d670d
jmp 0x6e7172
jmp 0x6e9b37
mov dword [ebp - 0x14], eax
jmp 0x736cca
Function at 0x766bcb
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0x67452301
push 0xa1acbcbc
jmp 0x76c2a3
je 0x6e8ce7
jmp 0x71e32d
pop eax
xor eax, 0x53fa366
rol eax, 0xa
xor eax, 0xfff84fdd
jmp 0x75d361
jmp 0x7372df
jmp 0x71e5eb
ret
jmp loc.006cec55
mov dword [eax + edx*4 + 0x248], 0x8f1bbcdc
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + edx*4 + 0x298], 0xca62c1d6
jmp 0x6f73e4
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x14
jne 0x700a07
jmp 0x6e96b2
jmp 0x71a1e3
add eax, ebp
add eax, 0x4c78daad
mov eax, dword [eax]
mov dword [eax + 0x18], 0xefcdab89
mov eax, dword [ebp - 4]
push 0x6d7eac
jmp 0x7560ac
xchg dword [esp], esi
pop esi
mov eax, dword [eax]
mov edx, dword [ebp - 8]
jmp 0x6f80ad
jmp 0x6f0670
Function at 0x100e3e60
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x100e404d
pushal
mov esi, section.UPX1
lea edi, [esi - 0x97000]
push edi
or ebp, 0xffffffff
jmp 0x100e3e8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x100e3e91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100e3e80
mov eax, 1
add ebx, ebx
jne 0x100e3ea3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x100e3eb4
jne 0x100e3ed3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100e3ed3
dec eax
add ebx, ebx
jne 0x100e3ec0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x100e3e98
add ebx, ebx
jne 0x100e3ecf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x100e3f25
xor ecx, ecx
sub eax, 3
jb 0x100e3eeb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x100e3f5a
sar eax, 1
mov ebp, eax
jmp 0x100e3ef6
add ebx, ebx
jne 0x100e3ef6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100e3ec4
inc ecx
add ebx, ebx
jne 0x100e3f04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100e3ec4
add ebx, ebx
jne 0x100e3f11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x100e3f06
jne 0x100e3f22
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100e3f06
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x100e3f44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x100e3f36
jmp 0x100e3e86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x100e3f44
add edi, ecx
jmp 0x100e3e86
pop esi
mov edi, esi
mov ecx, 0x2c33
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x100e3f62
cmp byte [edi], 0x1e
jne 0x100e3f62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x100e3f67
lea edi, [esi + 0xdc000]
mov eax, dword [edi]
or eax, eax
je 0x100e3fdf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe97b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe98b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x100e3f94
mov ecx, edi
jns 0x100e3fc3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe98b8]
or eax, eax
je 0x100e3fd9
mov dword [ebx], eax
add ebx, 4
jmp 0x100e3fb1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x100e4010
cmp al, 0xef
ja 0x100e4003
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100e3fe5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100e3ff2
mov ebp, dword [esi + 0xe98bc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x100e4044
sub esp, 0xffffff80
jmp 0x1005ff11
Function at 0x402a3d
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x423790]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x402ad1
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x402a8e
cmp dword [ebp + 0x10], ebx
jne 0x402ac5
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00402a3d
test eax, eax
jne 0x402aa0
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402a75
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00405ea3
cmp eax, ebx
je 0x402ad8
push ebx
push dword [0x423790]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402ad1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x423790], ebx
jne 0x402ace
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x402ace
jmp 0x402ad1
Function at 0x402e62
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x402e7f
mov dword [ebp - 8], 0x8000
and dword [ebp - 4], 0
mov ebx, edi
test edi, edi
jne 0x402e8e
mov ebx, 0x40e888
mov eax, dword [ebp + 8]
test eax, eax
jl 0x402ea3
mov ecx, dword [0x423738]
add ecx, eax
push ecx
call fcn.0040306b
lea eax, [ebp + 0x14]
push 4
push eax
call fcn.00403055
test eax, eax
je 0x403000
test byte [ebp + 0x17], 0x80
je 0x402fe9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40a7f8
mov dword [ebp - 0xc], eax
call fcn.00405f83
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x40304b
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x402ef3
mov esi, dword [ebp + 0x14]
mov edi, 0x40a888
push esi
push edi
call fcn.00403055
test eax, eax
je 0x403000
sub dword [ebp + 0x14], esi
mov dword [0x40a810], edi
mov dword [0x40a814], esi
mov eax, dword [ebp - 8]
mov ecx, 0x40a7f8
mov dword [0x40a818], ebx
mov dword [0x40a81c], eax
call fcn.00405fa3
test eax, eax
mov dword [ebp - 0x14], eax
jl 0x402fe1
mov esi, dword [0x40a818]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x423794], 1
mov edi, eax
je 0x402f95
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x402f62
cmp dword [ebp + 0x14], 0
jne 0x402f95
mov eax, dword [ebp + 8]
push dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x54]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push 0
call fcn.00404e63
mov dword [ebp - 0xc], edi
xor eax, eax
cmp esi, eax
je 0x402fd6
cmp dword [ebp + 0x10], eax
jne 0x402fbe
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402fe5
cmp dword [ebp - 0x10], esi
jne 0x402fe5
add dword [ebp - 4], esi
jmp 0x402fca
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov ebx, dword [0x40a818]
cmp dword [ebp - 0x14], 1
jne 0x402f16
jmp 0x40304b
cmp dword [ebp + 0x14], eax
jg 0x402ee6
jmp 0x40304b
push 0xfffffffffffffffc
jmp 0x403002
push 0xfffffffffffffffe
jmp 0x403002
test edi, edi
je 0x403040
cmp dword [ebp + 0x14], esi
jge 0x402ff5
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.00403055
test eax, eax
jne 0x403048
push 0xfffffffffffffffd
pop eax
jmp 0x40304e
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x403010
mov esi, dword [ebp + 0x14]
mov edi, 0x40a888
push esi
push edi
call fcn.00403055
test eax, eax
je 0x403000
lea eax, [ebp + 0x10]
push 0
push eax
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402fe5
cmp esi, dword [ebp + 0x10]
jne 0x402fe5
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x403005
jmp 0x40304b
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x40532b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x4214e0], 0x44
push eax
xor eax, eax
push 0x4214e0
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405366
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x4053f0
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.004057e4
mov edi, eax
cmp edi, 0xffffffff
je 0x405431
test byte [esp + 0x10], 1
push esi
je 0x405413
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x405419
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x405422
xor eax, eax
inc eax
jmp 0x405433
test byte [esp + 0x10], 4
jne 0x405431
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
ret 8