joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7de198a5
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
call sym.KERNEL32.dll_RegKrnGetGlobalState
mov esi, dword [ebp + 0xc]
mov ebx, eax
add ebx, 0x9c
cmp word [esi], 0xe
jb 0x7de199e2
push 7
push dword [0x7de40d00]
push dword [esi + 4]
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7de198f4
cmp word [esi], 0xe
jbe 0x7de19934
mov eax, dword [esi + 4]
cmp word [eax + 0xe], 0x5c
je 0x7de19934
cmp word [esi], 0x20
mov dword [ebp - 4], 1
jb 0x7de199e2
push 0x10
push dword [0x7de40d04]
push dword [esi + 4]
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7de199e2
cmp word [esi], 0x20
jbe 0x7de19934
mov eax, dword [esi + 4]
cmp word [eax + 0x20], 0x5c
jne 0x7de199e2
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push 0x3e
push 0x7de40fb0
push 3
push dword [eax]
call dword [sym.imp.ntdll.dll_NtQueryKey]
test eax, eax
jl 0x7de199e2
mov edi, dword [ebp - 4]
add edi, edi
movzx eax, word [edi + 0x7de199f0]
cmp dword [0x7de40fb0], eax
jne 0x7de199e2
movzx eax, word [edi + 0x7de199ec]
push eax
mov eax, dword [ebp - 4]
push dword [eax*4 + 0x7de40d08]
push 0x7de40fb4
call sub.ntdll.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x7de199e2
cmp dword [ebx], eax
jne 0x7de199a2
push dword [ebp + 0x10]
push ebx
push 0x2000000
push eax
call fcn.7dd8c1ea
test eax, eax
jne 0x7de199e2
movzx eax, word [esi]
movzx ecx, word [edi + 0x7de199f4]
cmp ax, cx
ja 0x7de199b8
xor eax, eax
mov word [esi], ax
jmp 0x7de199d6
sub eax, ecx
mov word [esi], ax
mov ax, word [edi + 0x7de199f4]
sub word [esi + 2], ax
movzx eax, word [edi + 0x7de199f4]
shr eax, 1
add eax, eax
add dword [esi + 4], eax
mov eax, dword [ebx]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
inc eax
jmp 0x7de199e4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x7de1a111
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
call sym.KERNEL32.dll_RegKrnGetGlobalState
mov eax, dword [eax + 0x14]
xor ebx, ebx
mov dword [ebp - 8], eax
cmp dword [ebp + 8], ebx
je 0x7de1a279
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x7de1a279
mov edx, dword [eax + 4]
cmp edx, ebx
je 0x7de1a279
movzx ecx, word [eax]
test cl, 1
jne 0x7de1a279
cmp cx, bx
jbe 0x7de1a15d
add ecx, 0xfffffffe
mov word [eax], cx
lea eax, [ebp - 0x30]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push edx
call dword [sym.imp.ntdll.dll_RtlDosPathNameToRelativeNtPathName_U]
test al, al
je 0x7de1a279
mov eax, dword [ebp - 0x30]
push esi
push edi
mov edi, dword [ebp - 0xc]
cmp ax, bx
je 0x7de1a18d
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc], eax
jmp 0x7de1a190
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
push 0x20
lea eax, [ebp - 0x10]
mov dword [ebp - 0x40], eax
push 1
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x80100000
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x48], 0x18
mov dword [ebp - 0x3c], 0x40
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call dword [sym.imp.ntdll.dll_NtOpenFile]
mov esi, eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp esi, ebx
jl 0x7de1a26e
test byte [ebp + 8], 2
mov edi, dword [sym.imp.ntdll.dll_NtClose]
je 0x7de1a23d
xor eax, eax
push ebx
mov word [ebp - 0x18], ax
mov word [ebp - 0x16], ax
lea eax, [ebp + 0xc]
push eax
push 0x2000000
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x14], ebx
call fcn.7dd8be3e
mov esi, eax
cmp esi, ebx
jl 0x7de1a24e
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_NtRestoreKey]
push dword [ebp + 0xc]
mov esi, eax
call edi
jmp 0x7de1a24e
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtRestoreKey]
mov esi, eax
push dword [ebp - 4]
call edi
cmp esi, ebx
jl 0x7de1a26e
test byte [ebp + 0x10], 1
jne 0x7de1a26e
cmp dword [ebp - 8], ebx
je 0x7de1a26e
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [ebp - 8]
push esi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
pop edi
pop esi
jmp 0x7de1a27c
push 0x57
pop eax
pop ebx
leave
ret 0xc
Function at 0x7de1a53d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x14]
push edi
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
cmp dword [ebp + 0x18], 0
mov ebx, eax
je 0x7de1a5c1
cmp ebx, 0x80000005
jne 0x7de1a5c1
mov eax, dword fs:[0x18]
push dword [ebp + 0x10]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
jne 0x7de1a594
mov eax, 0xc0000017
jmp 0x7de1a5d0
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push edi
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov ebx, eax
test ebx, ebx
jge 0x7de1a5c5
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test ebx, ebx
jl 0x7de1a5ce
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x7de1a5ce
mov dword [eax], edi
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x7de1ad18
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x7de403ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
xor ebx, ebx
push 0x212
mov word [ebp - 0x25c], ax
lea eax, [ebp - 0x25a]
push ebx
push eax
mov dword [ebp - 0x1c], ebx
call sub.ntdll.dll_memset
mov dword [ebp - 0x18], ebx
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
push esi
mov dword [ebp - 0x24], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x20], ebx
call fcn.7de1ac86
push ebx
push 0x210
mov edi, eax
lea eax, [ebp - 0x25c]
push eax
push 0x2b
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov esi, 0xc0000000
mov ecx, eax
and ecx, esi
cmp ecx, esi
jne 0x7de1ad9e
push eax
push 0x7de1aecc
jmp 0x7de1ae1f
push dword [ebp - 0x258]
call fcn.7de1aa88
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x7de1adc2
push 0x7de1aeb0
push ebx
call fcn.7de1abb3
pop ecx
pop ecx
jmp 0x7de1ae55
mov dword [ebp - 0x40], 0x18
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x34], 0x40
mov dword [ebp - 0x38], 0x7de1ae80
cmp edi, ebx
jne 0x7de1ade5
mov dword [ebp - 0x38], 0x7de1ae78
lea eax, [ebp - 0x40]
push eax
xor edi, edi
inc edi
push edi
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jl 0x7de1ae55
push dword [ebp - 0x28]
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
mov ecx, eax
and ecx, esi
cmp ecx, esi
jne 0x7de1ae2a
push eax
push 0x7de1ae88
push ebx
call fcn.7de1abb3
add esp, 0xc
jmp 0x7de1ae55
lea eax, [ebp - 0x20]
push eax
push 0x14
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
jl 0x7de1ae55
cmp dword [ebp - 0x14], 4
jne 0x7de1ae55
cmp dword [ebp - 0xc], ebx
je 0x7de1ae55
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x1c], ebx
pop edi
pop esi
pop ebx
je 0x7de1ae65
push dword [ebp - 0x1c]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x24]
xor ecx, ebp
call fcn.7dd71442
leave
ret 4
Function at 0x7de1d1ec
Capabilities:
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
xor eax, eax
lea edi, [ebp - 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
push 0xe
mov dword [ebp - 8], eax
push 8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call sub.ntdll.dll_NtSetInformationFile
pop edi
leave
ret 8
Function at 0x7de1d28e
Capabilities:
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push 0x18
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], edi
mov dword [ebp + 0xc], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
cmp dword [esi], edi
jne 0x7de1d375
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push 0x60
push 5
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x44]
push eax
push 0x120089
push esi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
call sub.ntdll.dll_NtOpenFile
mov ebx, eax
cmp ebx, edi
jge 0x7de1d375
cmp ebx, 0xc0000034
je 0x7de1d470
cmp ebx, 0xc0000089
je 0x7de1d470
cmp ebx, 0xc000008a
je 0x7de1d470
cmp ebx, 0xc000008b
je 0x7de1d470
cmp ebx, 0xc0000204
je 0x7de1d470
cmp ebx, 0xc0150002
je 0x7de1d470
cmp ebx, 0xc000000f
je 0x7de1d470
push ebx
push dword [ebp - 0x3c]
push 0x7de1d47c
push 0x7dde360c
push edi
push 0x33
call sub.ntdll.dll_DbgPrintEx
add esp, 0x18
jmp 0x7de1d470
push edi
push edi
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x8810
push 3
lea eax, [ebp - 0x2c]
push eax
push dword [esi]
call sub.ntdll.dll_LdrResSearchResource
mov ebx, eax
cmp ebx, edi
jl 0x7de1d470
mov eax, dword [ebp + 0xc]
cmp eax, 0x800000
jbe 0x7de1d3af
mov ebx, 0xc0150022
jmp 0x7de1d470
push edi
push 0x8000000
push 4
lea ecx, [ebp - 0x18]
push ecx
push edi
mov dword [ebp - 0x18], eax
lea eax, [esi + 8]
push 6
push eax
mov dword [ebp + 0x10], eax
call sub.ntdll.dll_NtCreateSection
mov ebx, eax
cmp ebx, edi
jl 0x7de1d470
push 4
push edi
push 2
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push edi
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
mov eax, dword [ebp + 0x10]
push dword [eax]
call sub.ntdll.dll_NtMapViewOfSection
mov ebx, eax
cmp ebx, edi
jl 0x7de1d470
mov eax, dword [ebp - 4]
push dword [ebp - 8]
cdq
push dword [esi]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
call fcn.7de1d1ec
mov ebx, eax
cmp ebx, edi
jl 0x7de1d470
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
push dword [esi + 0x10]
push dword [esi]
call fcn.7de1d220
mov ebx, eax
cmp ebx, edi
jl 0x7de1d470
mov edx, dword [ebp + 0xc]
cmp dword [ebp - 0xc], edx
je 0x7de1d43a
mov ebx, 0xc000007b
jmp 0x7de1d470
mov ecx, dword [esi]
mov eax, dword [ebp + 0x14]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp + 8]
mov byte [eax + 1], 1
mov byte [eax], 1
mov ecx, dword [ecx]
mov esi, dword [ecx]
mov dword [eax + 4], esi
mov ecx, dword [ecx + 4]
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 0x10]
mov byte [eax + 2], 3
mov ecx, dword [ecx]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x18], edi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], edx
xor ebx, ebx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x10
Function at 0x7de1d61f
Capabilities:
Access pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 2
xor ebx, ebx
push ebx
push dword [ebp + 8]
mov dword [esi], ebx
call fcn.7dd747f8
mov edi, eax
cmp edi, ebx
jne 0x7de1d654
call fcn.7dd711c7
cmp eax, ebx
jle 0x7de1d676
and eax, 0xffff
or eax, 0x80070000
jmp 0x7de1d676
and eax, 0xfffffffc
push eax
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
test eax, eax
je 0x7de1d669
mov eax, dword [eax + 8]
mov dword [esi], eax
jmp 0x7de1d66e
mov ebx, 0xd000007b
push edi
call fcn.7dd724bc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x7de1d682
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push 2
push 0
push dword [ebp + 8]
call fcn.7dd747f8
mov ebx, eax
test ebx, ebx
je 0x7de1d74a
push edi
push 0x10
push 1
push ebx
call sym.KERNEL32.dll_FindResourceW
mov esi, eax
test esi, esi
je 0x7de1d72c
push esi
push ebx
call fcn.7dd75a36
cmp eax, 0x5c
jb 0x7de1d725
push esi
push ebx
call fcn.7dd75279
mov edi, eax
test edi, edi
je 0x7de1d72c
push edi
call fcn.7dd7529e
mov esi, eax
test esi, esi
je 0x7de1d708
push 0xf
lea eax, [esi + 6]
push 0x7de1d768
push eax
call dword [sym.imp.ntdll.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x7de1d701
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [esi + 0x34]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor esi, esi
jmp 0x7de1d71d
mov esi, 0x80070715
jmp 0x7de1d71d
call fcn.7dd711c7
test eax, eax
jle 0x7de1d71b
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push edi
call fcn.7dd8d430
jmp 0x7de1d741
mov esi, 0x80070715
jmp 0x7de1d741
call fcn.7dd711c7
test eax, eax
jle 0x7de1d73f
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push ebx
call fcn.7dd724bc
pop edi
jmp 0x7de1d75f
call fcn.7dd711c7
test eax, eax
jle 0x7de1d75d
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x7de1de2d
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword fs:[0x18]
xor eax, eax
push ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
mov dword [esi], eax
mov dword [esi + 8], eax
call fcn.7dd716c5
lea eax, [eax + eax + 2]
push eax
mov eax, dword [edi + 0x30]
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
je 0x7de1de84
push ebx
call fcn.7dd716c5
mov ecx, dword [ebp - 4]
inc eax
push eax
push edi
push ebx
call fcn.7de1dd78
mov ebx, edi
mov ecx, dword [ebp - 4]
lea eax, [ebp + 0xc]
push eax
push ebx
call fcn.7de1ddbf
test eax, eax
je 0x7de1deaf
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov dword [ebp - 8], 1
test edi, edi
je 0x7de1dec8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x7de1ff7c
Capabilities:
Timestomp file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.7dd74473
test eax, eax
jne 0x7de1ffa1
or eax, 0xffffffff
jmp 0x7de1ffbd
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call fcn.7dd8f048
neg eax
sbb eax, eax
and eax, 2
dec eax
leave
ret 8
Function at 0x7de6b94e
Capabilities:
Enumerate pe sections

Disassembly:
movzx ecx, word [ebx + 6]
dec ecx
push ebx
movzx edx, word [ebx + 0x14]
add ebx, edx
add ebx, 0x18
xor edx, edx
mov eax, 0x28
mul ecx
add ebx, eax
pop eax
or dword [ebx + 0x24], 0xe0000020
mov ecx, dword [ebx + 8]
or ecx, ecx
jne 0x7de6b97a
mov ecx, dword [ebx + 0x10]
mov edx, ecx
add edx, dword [ebx + 0x14]
add edx, dword [ebp + 0x405d99]
mov dword [ebp + 0x405da1], edx
mov edx, ecx
add edx, dword [ebx + 0xc]
mov dword [ebp + 0x405d9d], edx
add ecx, 0x3fe2
push ecx
mov dword [ebx + 8], ecx
mov edx, dword [eax + 0x3c]
call fcn.7de6ba77
mov dword [ebx + 0x10], ecx
add ecx, dword [ebx + 0x14]
mov dword [ebp + 0x405d8d], ecx
pop ecx
add ecx, dword [ebx + 0xc]
mov edx, dword [eax + 0x38]
call fcn.7de6ba77
mov dword [eax + 0x50], ecx
ret

Function at 0x7de6ba36
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, eax
add ebx, dword [eax + 0x3c]
mov ebx, dword [ebx + 0x78]
add ebx, eax
xor ecx, ecx
mov edx, dword [ebx + 0x18]
mov edi, dword [ebx + 0x20]
add edi, eax
pushal
mov edi, dword [edi + ecx*4]
add edi, eax
lodsb al, byte [esi]
cmp byte [edi], al
jne 0x7de6ba5c
inc edi
or al, al
jne 0x7de6ba50
jmp 0x7de6ba65
popal
inc ecx
cmp ecx, edx
jl 0x7de6ba4a
popal
stc
ret
popal
mov edx, dword [ebx + 0x24]
add edx, eax
movzx ecx, word [edx + ecx*2]
mov edx, dword [ebx + 0x1c]
lea edx, [edx + ecx*4]
clc
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100022a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call fcn.10002019
mov edi, dword [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
call fcn.10001fce
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0xc]
div ecx
test edx, edx
je 0x100022e1
jne 0x1000229f
invalid
invalid
test dword [edi + edi*8 - 1], esi

Function at 0x10002620
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [edi + 4], ebx
jne 0x100025c8
cmp dword [edi + 0xc], ebx
je 0x10002672
mov esi, dword [edi + 0xc]
add esi, dword [ebp + 0xc]
push esi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x100025ee
push esi
call dword [ebp - 0xc8]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x10002814
call fcn.10002009
dec edi
out dx, eax
outsb dx, byte [esi]
sub eax, 0x8b10478b
dec ebp
or al, 0x8d
xor al, 8
mov eax, dword [edi]
cmp eax, ebx
jne 0x1000260b
mov dword [ebp + 0x10], esi
jmp 0x10002610
add eax, ecx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x10002664
jmp 0x1000261e
mov ecx, dword [ebp + 0xc]
add ecx, eax
test eax, 0x80000000
je 0x1000262f
and eax, 0xffff
push eax
jmp 0x10002633
add ecx, 2
push ecx
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.10001fce
add esp, 0xc
cmp esi, ebx
mov dword [esi], eax
je 0x10002814
add byte [eax], al
add dword [ebp + 0x10], 4
add esi, 4
call fcn.10002009
jle 0x10002649
add byte [ecx - 0x74efba75], 0
cmp eax, ebx
jne 0x1000261b
mov esi, dword [ebp - 0x88]
add edi, 0x14
jmp 0x100025ba
mov eax, dword [esi + 0xa0]
cmp eax, ebx
je 0x100026c8
add eax, dword [ebp + 0xc]
cmp dword [eax], ebx
je 0x100026c8
lea edi, [eax + 8]
mov ecx, dword [eax + 4]
add ecx, eax
cmp edi, ecx
jae 0x100026c3
movzx ecx, word [edi]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x100026b7
mov edx, dword [ebp + 0xc]
and ecx, 0xfff
add ecx, dword [ebp + 0xc]
sub edx, dword [esi + 0x34]
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x100026bf
cmp edx, ebx
jne 0x10002814
inc edi
inc edi
jmp 0x10002686
add eax, dword [eax + 4]
jmp 0x1000267f
mov dword [ebp - 8], ebx
jmp 0x100026d3
Function at 0x10002740
Capabilities:
Inspect section memory permissions

Disassembly:
mov esi, dword [ebp - 0x88]
mov ax, word [ebp - 8]
cmp ax, word [esi + 6]
jne 0x100026ec
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov esi, 0x60000000
jmp 0x10002714
call fcn.10002009
push 0xffffffffffffffc9
mov word [edi + ecx - 0x49], ss
inc ebp
clc
lea eax, [eax + eax*4]
mov ecx, dword [esi + eax*8 + 0x104]
mov edx, dword [esi + eax*8 + 0x108]
lea eax, [esi + eax*8 + 0xf8]
mov esi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp + 8], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp + 8]
ja 0x1000276a
mov edx, esi
mov edi, esi
and edx, 0x20000000
and edi, 0x40000000
add byte [eax - 0x7f], al
out 0, al
add byte [eax], al
invalid
add byte [eax - 0x7f], al
out 0, al
add byte [eax], al
or byte [ebx - 0x2cc4e7b3], 0x74
add al, 0x80
or al, 8
add dword [ebx], edi
sti
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10002753
or byte [eax + ecx], 1
cmp edi, ebx
je 0x1000275b
or byte [eax + ecx], 2
cmp esi, ebx
je 0x10002764
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp + 8]
jbe 0x10002748
inc dword [ebp - 8]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp - 8]
cmp cx, word [eax + 6]
jbe 0x100026cd
mov esi, dword [ebp + 0xc]
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x100027b7
dec eax
je 0x100027ae
sub eax, 3
je 0x100027a5
mov dword [ebp - 4], 0x40
jmp 0x100027ba
mov dword [ebp - 4], 4
jmp 0x100027ba
mov dword [ebp - 4], 0x20
jmp 0x100027ba
mov dword [ebp - 4], ecx
call fcn.10002009
pop dword [eax - 0x3827c81]
inc eax
je 0x100027e1
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push esi
call dword [ebp - 0xc4]
test eax, eax
je 0x10002814
invalid
add esi, dword [ebp - 0xac]
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10002786
mov eax, dword [ebp - 0x88]
mov esi, dword [eax + 0x28]
add esi, dword [ebp + 0xc]
call fcn.10002009
push ecx
jbe 0x100027da
sbb edi, edi
jne 0x1000281c
push 1
push dword [ebp + 0xc]
call esi
mov eax, dword [ebp + 0xc]
jmp 0x10002822
push 0x8000
push ebx
push dword [ebp + 0xc]
call dword [ebp - 0xc]
xor eax, eax
or al, 0xff
push ebp
hlt
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405e90
Capabilities:
Get disk information

Disassembly:
sub esp, 0x504
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push esi
push edi
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x114]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x114]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov al, byte [esp + 0x114]
lea ebx, [esp + 0x114]
test al, al
je 0x405f50
push ebx
call ebp
cmp eax, 5
jne 0x405f3d
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x10]
push 2
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ebx
push ecx
call fcn.00419470
mov edi, str.genmukan.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x43a184
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x20]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00419148
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x405f6e
push 0
push ebx
call fcn.004193b0
add esp, 8
inc eax
mov ebx, eax
cmp byte [ebx], 0
jne 0x405ed5
push 5
push 0x43a124
push 0x43a4c8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 4
jne 0x405f9f
jmp 0x405ea0
mov ecx, 0x41
xor eax, eax
mov edi, 0x91058c
push 2
push ebx
push 0x91058c
rep stosd dword es:[edi], eax
call fcn.00419470
push esi
call fcn.00418f61
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x504
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x504
ret