joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408e84
nop
mov ecx, 0x169f3bf7
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x72525c3d
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x7091526b
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, str.J
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x3d6309d2
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x75b8146e
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 7
pop ecx
xor eax, eax
mov edi, 0x75b8e040
rep stosd dword es:[edi], eax
xor edi, edi
push 0x75b82946
inc edi
push 0x75b81514
mov dword [0x75b8e040], 0x20
mov dword [0x75b8e048], edi
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
xor ebx, ebx
cmp eax, ebx
mov dword [0x75b8e05c], eax
je 0x75b818c4
push 0xbb8
push ebx
push 2
call fcn.75b81528
cmp byte [0x75b8e008], bl
je 0x75b818a0
call fcn.75b815b8
test eax, eax
je 0x75b8150c
mov byte [0x75b8e008], bl
mov esi, dword [sym.imp.RPCRT4.dll_RpcServerRegisterAuthInfoA]
push ebx
push ebx
push 0xa
push ebx
call esi
test eax, eax
jne 0x75b81896
push ebx
push ebx
push 9
push ebx
call esi
test eax, eax
jne 0x75b81896
push ebx
push ebx
push 4
call fcn.75b81528
pop edi
pop esi
pop ebx
ret 8
push ebx
push ebx
push edi
jmp 0x75b81501
call fcn.75b82901
jmp 0x75b8150c
call fcn.75b816c2
test eax, eax
jl 0x75b8150c
call fcn.75b81592
test eax, eax
jne 0x75b814d9
call fcn.75b84057
jmp 0x75b8150c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x75b818dc
call sub.ntdll.dll_DbgPrint
pop ecx
pop ecx
jmp 0x75b81506
Function at 0x75b82ff2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
test eax, eax
jge 0x75b83012
xor eax, eax
jmp 0x75b8316a
push ebx
mov ebx, dword [sym.imp.ntdll.dll_NtQueryValueKey]
push edi
lea eax, [ebp + 0xc]
push eax
xor edi, edi
push edi
push edi
push 2
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call ebx
cmp eax, edi
jge 0x75b83055
cmp eax, 0xc0000023
je 0x75b83055
cmp eax, 0xc000003a
je 0x75b8304d
cmp eax, 0xc0000034
je 0x75b8304d
xor eax, eax
jmp 0x75b83168
xor eax, eax
inc eax
jmp 0x75b83168
push esi
mov eax, dword fs:[0x18]
push dword [ebp + 0xc]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
cmp esi, edi
mov dword [ebp - 4], esi
je 0x75b830a0
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push esi
push 2
push eax
push dword [ebp + 8]
call ebx
test eax, eax
jge 0x75b830a7
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
jmp 0x75b83167
cmp dword [esi + 4], 7
je 0x75b830b5
mov eax, dword fs:[0x18]
jmp 0x75b83092
lea eax, [esi + 0xc]
mov dword [ebp - 8], eax
xor ebx, ebx
jmp 0x75b830c9
inc eax
inc eax
cmp word [eax], di
jne 0x75b830bf
inc ebx
inc eax
inc eax
mov cx, word [eax]
cmp cx, di
jne 0x75b830bf
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, ebx
shl ecx, 3
push ecx
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
cmp eax, edi
mov dword [ebp + 8], eax
jne 0x75b830f9
mov eax, dword fs:[0x18]
jmp 0x75b83092
mov ecx, dword [ebp + 0x18]
mov esi, dword [ebp - 8]
mov dword [ecx], ebx
cmp word [esi], di
je 0x75b83154
mov ebx, eax
push esi
push ebx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
test eax, eax
jge 0x75b83145
mov eax, dword fs:[0x18]
push dword [ebp + 8]
mov eax, dword [eax + 0x30]
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
push edi
push dword [eax + 0x18]
call esi
mov eax, dword fs:[0x18]
push dword [ebp - 4]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call esi
jmp 0x75b830a0
inc esi
inc esi
cmp word [esi], di
jne 0x75b83143
add ebx, 8
inc esi
inc esi
cmp word [esi], di
jne 0x75b83108
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
xor eax, eax
inc eax
pop esi
pop edi
pop ebx
leave
ret 0x14
Function at 0x75b84e2f
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [sym.imp.ntdll.dll_NtQueryKey]
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x14]
push dword [esi]
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
cmp eax, 0x80000005
jne 0x75b84e9f
cmp dword [ebp + 0x18], 0
je 0x75b84e6d
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x10]
movzx edx, word [ebp + 0x1c]
inc ecx
inc ecx
cmp edx, ecx
jb 0x75b84e9f
mov ebx, dword [ebp + 0x14]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
test eax, eax
mov dword [esi], eax
jne 0x75b84e92
mov eax, 0xc0000017
jmp 0x75b84e9f
lea ecx, [ebp + 0x14]
push ecx
push ebx
push eax
push 2
push dword [ebp + 8]
call edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x75b87667
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push esi
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push edi
push 0x75b82538
lea eax, [ebp - 0x20]
xor edi, edi
push eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], 1
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call esi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push eax
push 0x20019
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x38], 0x18
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 0x40
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jl 0x75b877d1
mov esi, 0x400
push ebx
mov dword [ebp - 4], esi
mov eax, dword fs:[0x18]
push dword [ebp - 4]
mov eax, dword [eax + 0x30]
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
cmp ebx, edi
je 0x75b877c1
lea eax, [ebp - 4]
push eax
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQueryValueKey]
push ebx
push 2
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
call esi
mov edi, 0x80000005
jmp 0x75b8774b
mov dword [ebp + 8], ebx
mov eax, dword fs:[0x18]
push dword [ebp - 4]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov ebx, eax
test ebx, ebx
je 0x75b87751
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push ebx
push 2
push eax
push dword [ebp - 8]
call esi
cmp eax, edi
jne 0x75b87773
jmp 0x75b87717
cmp dword [ebp + 8], 0
je 0x75b8776e
mov eax, dword fs:[0x18]
push dword [ebp + 8]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, 0xc0000017
test eax, eax
jl 0x75b877a5
mov eax, dword [ebx + 4]
cmp eax, dword [ebp + 0xc]
jne 0x75b877a8
mov ecx, dword [ebx + 8]
cmp ecx, dword [ebp + 0x10]
ja 0x75b877a8
mov edi, dword [ebp + 0x14]
and dword [ebp - 0x10], 0
mov eax, ecx
shr ecx, 2
lea esi, [ebx + 0xc]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
and dword [ebp - 0xc], 0
rep movsb byte es:[edi], byte [esi]
jmp 0x75b877a8
mov dword [ebp - 0xc], eax
test ebx, ebx
je 0x75b877c1
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 0x10], 0
pop ebx
je 0x75b877ec
mov ecx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x14]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
and dword [ebp - 0xc], 0
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
leave
ret 0x18
Function at 0x75b87d28
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x75b8e004]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
push edi
lea ecx, [ebp - 0x414]
push ecx
push 0x208
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jbe 0x75b87dca
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x75b87dca
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x75b87db9
lea eax, [ebp - 0x418]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp - 0x41c], eax
je 0x75b87db9
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x418]
mov dword [esi + 0xc], eax
jmp 0x75b87dc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x75b87dd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.75b8c8aa
leave
ret 8

Function at 0x75b87de8
Capabilities:
Access the windows event log
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 4
lea eax, [ebp - 4]
push eax
push 4
xor edi, edi
push edi
push 0x75b82684
push dword [ebp + 8]
xor esi, esi
inc esi
mov dword [ebp - 4], esi
call sub.ADVAPI32.dll_RegSetValueExW
cmp dword [0x75b8e538], esi
jl 0x75b87e43
cmp eax, edi
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push edi
push esi
push edi
jne 0x75b87e31
push 0xc00003f9
jmp 0x75b87e36
push 0xc00003fa
push edi
push esi
push dword [0x75b8e514]
call sub.ADVAPI32.dll_ReportEventW
pop edi
xor eax, eax
pop esi
leave
ret 8
Function at 0x75b87e91
Capabilities:
Get process heap force flags
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [ebp + 0xc]
xor esi, esi
cmp dword [ebp + 0x20], esi
lea eax, [ebp - 0xc]
mov word [ebp - 0xc], si
mov word [ebp - 0xa], si
mov dword [ebp - 8], esi
push eax
je 0x75b87ebb
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeString]
jmp 0x75b87ec1
call dword [sym.imp.ntdll.dll_RtlCreateUnicodeStringFromAsciiz]
movzx eax, al
cmp eax, esi
je 0x75b87fce
push ebx
push edi
mov edi, dword [ebp + 0x1c]
mov eax, dword [edi]
add eax, 0x10
mov dword [ebp + 0xc], eax
mov esi, eax
mov eax, dword fs:[0x18]
push dword [ebp + 0xc]
mov eax, dword [eax + 0x30]
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
test ebx, ebx
je 0x75b87fbb
lea eax, [ebp + 0xc]
push eax
push esi
push ebx
push 2
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, eax
test esi, esi
mov edx, 0x80000005
jge 0x75b87f24
cmp esi, edx
jne 0x75b87fa4
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x75b87f30
mov ecx, dword [ebx + 4]
mov dword [eax], ecx
test esi, esi
mov eax, dword [ebx + 8]
mov dword [edi], eax
jl 0x75b87fa4
cmp dword [ebp + 0x18], 0
je 0x75b87fa4
cmp dword [ebp + 0x20], 0
jne 0x75b87f7b
mov ecx, dword [ebx + 4]
cmp ecx, 1
je 0x75b87f57
cmp ecx, 2
je 0x75b87f57
cmp ecx, 7
jne 0x75b87f7b
push dword [ebp + 0xc]
and dword [ebp - 4], 0
lea ecx, [ebx + 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0x18]
call dword [sym.imp.ntdll.dll_RtlUnicodeToMultiByteN]
mov esi, eax
test esi, esi
jl 0x75b87fa4
mov eax, dword [ebp - 4]
jmp 0x75b87fa2
mov ecx, dword [ebx + 8]
cmp ecx, dword [edi]
ja 0x75b87f9d
mov edi, dword [ebp + 0x18]
mov eax, ecx
shr ecx, 2
lea esi, [ebx + 0xc]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0x1c]
xor esi, esi
jmp 0x75b87f9f
mov esi, edx
mov eax, dword [ebx + 8]
mov dword [edi], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x75b87fc0
mov esi, 0xc0000017
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
pop edi
pop ebx
jmp 0x75b87fd3
mov esi, 0xc0000017
push esi
call fcn.75b87e50
pop esi
leave
ret 0x1c
Function at 0x75b88020
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
cmp dword [ebp + 0xc], eax
mov dword [ebp - 4], eax
jne 0x75b88045
mov eax, dword [ebp + 8]
push 0x75b880c8
push dword [eax + 0x38]
call sub.ADVAPI32.dll_RegDeleteValueW
xor eax, eax
jmp 0x75b880c0
push esi
mov esi, dword [ebp + 8]
push edi
push 1
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp + 8]
push ecx
push eax
mov edi, 0x75b880c8
push edi
push dword [esi + 0x38]
mov dword [ebp - 8], 4
call fcn.75b87e91
test eax, eax
je 0x75b88076
and dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
add dword [ebp - 4], eax
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push edi
push dword [esi + 0x38]
call sub.ADVAPI32.dll_RegSetValueExW
mov eax, dword [esi + 0x1a0]
cmp dword [ebp - 4], eax
jb 0x75b880a4
test eax, eax
je 0x75b880a4
push esi
call fcn.75b87fe3
mov eax, dword [ebp - 4]
cmp eax, 0x64
pop edi
pop esi
jb 0x75b880c0
push 0x64
xor edx, edx
pop ecx
div ecx
push 0xa
pop eax
cmp eax, edx
sbb eax, eax
not eax
and eax, edx
leave
ret 8
Function at 0x75b8a1c2
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov cx, ax
shr cx, 0xc
cmp cx, 0xa
movzx ecx, cx
jae 0x75b8a1e2
add ecx, 0x30
jmp 0x75b8a1e5
add ecx, 0x57
mov edx, dword [ebp + 8]
movsx cx, cl
mov word [edx], cx
xor ecx, ecx
mov cl, ah
and ecx, 0xf
cmp cx, 0xa
movzx ecx, cx
jae 0x75b8a204
add ecx, 0x30
jmp 0x75b8a207
add ecx, 0x57
movsx cx, cl
mov word [edx + 2], cx
xor ecx, ecx
mov cl, al
shr cl, 4
and ecx, 0xf
cmp cx, 0xa
movzx ecx, cx
jae 0x75b8a227
add ecx, 0x30
jmp 0x75b8a22a
add ecx, 0x57
movsx cx, cl
and eax, 0xf
cmp ax, 0xa
mov word [edx + 4], cx
movzx eax, ax
jae 0x75b8a243
add eax, 0x30
jmp 0x75b8a246
add eax, 0x57
and word [edx + 8], 0
movsx ax, al
mov word [edx + 6], ax
pop ebp
ret 4

Function at 0x75b8a2cf
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov ecx, dword [ebp + 0x10]
mov eax, dword [0x75b8e004]
push ebx
push esi
push edi
mov dword [ebp - 0x274], ecx
xor ecx, ecx
push ecx
push ecx
push ecx
lea edx, [ebp - 0x26c]
push edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov dword [ebp - 0x270], eax
xor eax, eax
cmp dword [ebp - 0x270], 0xffffffff
mov esi, 0x75b8e9d0
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
je 0x75b8a3dd
cmp byte [ebp + 0xc], bl
je 0x75b8a3c2
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xc
jne 0x75b8a3a6
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 5
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x10]
push eax
call fcn.75b8a25c
test eax, eax
je 0x75b8a3a6
lea ecx, [ebp - 0x1c]
push ecx
push eax
call fcn.75b8a149
push dword [ebp - 0x274]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
cmp bl, 1
jne 0x75b8a3a6
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x26c]
push eax
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x75b8a3d1
jmp 0x75b8a330
push dword [ebp - 0x274]
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x270]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
neg bl
pop edi
sbb ebx, ebx
and ebx, esi
pop esi
mov eax, ebx
pop ebx
call fcn.75b8c8aa
leave
ret 0xc
Function at 0x75b8a3f9
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x75b8e004]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, 0x75b8e5a0
mov dword [ebp - 0x18], eax
mov esi, 0x82
push 0x104
xor eax, eax
mov ecx, esi
mov edi, ebx
push ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, esi
mov esi, 0x75b8e7c0
xor eax, eax
cmp dword [ebp - 0x18], 4
mov edi, esi
push ebx
rep stosd dword es:[edi], eax
push esi
jne 0x75b8a4fc
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x75b81980
push esi
call ebx
push dword [0x75b8e4b0]
push esi
call ebx
push dword [ebp - 0x14]
push esi
call ebx
push dword [0x75b8e4c0]
push esi
call ebx
push dword [ebp - 0x14]
push 0
push esi
call fcn.75b8a2cf
mov edi, eax
test edi, edi
jne 0x75b8a590
push dword [ebp - 0x14]
call fcn.75b8a25c
mov ecx, eax
test ecx, ecx
je 0x75b8a590
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x10]
push eax
push ecx
call fcn.75b8a149
push 0x75b8e5a0
xor eax, eax
mov ecx, 0x82
mov edi, esi
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x75b81980
push esi
call ebx
push dword [0x75b8e4ac]
push esi
call ebx
lea eax, [ebp - 0x10]
push eax
push esi
call ebx
push dword [0x75b8e4c0]
push esi
call ebx
lea eax, [ebp - 0x10]
push eax
push 0
jmp 0x75b8a588
xor eax, eax
mov ecx, 0x82
mov edi, esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x75b81980
push esi
call ebx
push dword [0x75b8e4ac]
push esi
call ebx
push dword [ebp - 0x14]
push esi
call ebx
push dword [0x75b8e4c0]
push esi
call ebx
push dword [ebp - 0x14]
push 0
push esi
call fcn.75b8a2cf
mov edi, eax
test edi, edi
jne 0x75b8a590
push 0x75b8e5a0
mov ecx, 0x82
mov edi, esi
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x75b81980
push esi
call ebx
push dword [0x75b8e4b0]
push esi
call ebx
push 0x75b8a5a4
push esi
call ebx
mov edi, dword [ebp - 0x14]
lea eax, [edi + 2]
push eax
push esi
call ebx
push dword [0x75b8e4c0]
push esi
call ebx
push edi
push 1
push esi
call fcn.75b8a2cf
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.75b8c8aa
leave
ret 4
Function at 0x713e54
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
pop eax
pop ebx
pop edi
push eax
cmp edi, 0xffff
ja 0x713e64
mov ecx, edi
xor edi, edi
mov edx, ebx
cmp word [ebx], 0x5a4d
jne 0x713ed3
movzx eax, word [ebx + 0x3c]
add ebx, eax
cmp word [ebx], 0x4550
jne 0x713ed3
mov ebx, dword [ebx + 0x78]
add ebx, edx
or edi, edi
je 0x713ec4
mov esi, dword [ebx + 0x20]
add esi, edx
mov ecx, dword [ebx + 0x18]
push ebx
xor ebx, ebx
lodsd eax, dword [esi]
add eax, edx
push esi
push edi
xchg esi, edi
xchg edi, eax
lodsb al, byte [esi]
or al, al
jne 0x713ea2
cmp byte [edi], 0
je 0x713eab
jmp 0x713ea9
cmp byte [edi], al
jne 0x713ea9
inc edi
jmp 0x713e96
mov al, 1
pop edi
pop esi
or al, al
je 0x713eb7
inc ebx
loop 0x713e8e
pop ebx
jmp 0x713ed3
xchg ebx, eax
pop ebx
mov esi, dword [ebx + 0x24]
add esi, edx
movzx ecx, word [esi + eax*2]
jmp 0x713ec7
sub ecx, dword [ebx + 0x10]
mov esi, dword [ebx + 0x1c]
add esi, edx
xchg ecx, eax
mov eax, dword [esi + eax*4]
add eax, edx
ret
xor eax, eax
ret

Function at 0x714556
Capabilities:
Parse pe header

Disassembly:
enter 4, 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x71458d
cmp word [eax], 0x5a4d
jne 0x71458d
mov ecx, eax
add eax, dword [eax + 0x3c]
cmp word [eax], 0x4550
jne 0x71458d
cmp dword [eax + 0x88], 0
je 0x71458d
push ecx
call fcn.007146c5
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x1006edf
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push 0
push 2
lea eax, [ebp - 4]
push eax
push 0x23
call dword [0x10014d8]
cmp byte [ebp - 4], 0
jne 0x1006f0a
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
cmp byte [eax + 2], 0
je 0x1006f15
push 0x1006ece
call dword [0x1001224]
leave
ret
Function at 0x401030
Capabilities:
Encode data using base64

Disassembly:
push esi
mov esi, eax
test edi, edi
jne 0x40103e
mov eax, 0x1c
pop esi
ret
xor ecx, ecx
xor eax, eax
push ebx
jmp 0x401050
movzx edx, byte [esi + ecx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + eax], dl
movzx edx, byte [esi + ecx]
movzx ebx, byte [esi + ecx + 1]
and edx, 3
shl edx, 4
shr ebx, 4
or edx, ebx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + eax + 1], dl
movzx edx, byte [esi + ecx + 1]
movzx ebx, byte [esi + ecx + 2]
and edx, 0xf
add edx, edx
add edx, edx
shr ebx, 6
or edx, ebx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + eax + 2], dl
movzx edx, byte [esi + ecx + 2]
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + eax + 3], dl
add ecx, 3
add eax, 4
cmp ecx, 0x12
jb 0x401050
movzx edx, byte [ecx + esi]
shr edx, 2
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + edi], dl
lea edx, [ecx + esi + 1]
movzx ecx, byte [ecx + esi]
movzx esi, byte [edx]
and ecx, 3
shl ecx, 4
shr esi, 4
or ecx, esi
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + edi + 1], cl
movzx edx, byte [edx]
and edx, 0xf
movzx ecx, byte [edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
pop ebx
mov byte [eax + edi + 2], cl
mov byte [eax + edi + 3], 0x3d
add eax, 4
pop esi
ret