joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ea4f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [ecx + 4]
xor bl, bl
cmp dword [eax + 0x14], 0x10
jb 0x5ea502
mov eax, dword [eax]
lea edx, [ebp - 4]
push edx
mov edx, dword [ecx + 0x28]
or edx, 0x20019
push edx
push 0
push eax
mov eax, dword [ecx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5ea54d
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
jb 0x5ea52b
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
push 0
push 0
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
test eax, eax
push edx
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x5eaca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x669220
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
xor esi, esi
mov edi, ecx
mov dword [ebp - 0x14], esi
call fcn.005eab10
mov ebx, dword [ebp + 0xc]
cmp dword [ebx + 0x14], 0x10
jb 0x5eacd7
mov eax, dword [ebx]
jmp 0x5eacd9
mov eax, ebx
lea ecx, [ebp - 0x10]
push ecx
push esi
lea edx, [ebp - 0x14]
push edx
push esi
push eax
mov eax, dword [edi + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5eaddb
mov eax, dword [ebp - 0x14]
cmp eax, 1
je 0x5ead07
cmp eax, 2
jne 0x5eaddb
mov eax, dword [ebp - 0x10]
cmp eax, esi
jbe 0x5eadb8
inc eax
push eax
call fcn.005fb5ce
add esp, 4
cmp dword [ebx + 0x14], 0x10
mov esi, eax
jb 0x5ead28
mov eax, dword [ebx]
jmp 0x5ead2a
mov eax, ebx
mov edx, dword [edi + 0x20]
lea ecx, [ebp - 0x10]
push ecx
push esi
xor ebx, ebx
push ebx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x10]
mov byte [esi + eax], bl
mov edi, 0xf
mov eax, esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x5ead57
sub eax, ecx
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.0041e350
push esi
mov dword [ebp - 4], 1
call fcn.00611a0b
mov esi, dword [ebp + 8]
add esp, 4
lea ecx, [ebp - 0x30]
push ecx
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
mov ecx, esi
mov byte [esi], 0
call fcn.004647c0
cmp dword [ebp - 0x1c], 0x10
jb 0x5eada3
mov edx, dword [ebp - 0x30]
push edx
call fcn.0060faf6
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x10], esi
pop edi
mov dword [eax + 0x14], 0xf
pop esi
mov byte [eax], 0
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push ebx
lea eax, [ebp - 0x30]
push eax
mov ecx, edi
call fcn.005eaa10
push esi
push eax
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], esi
call fcn.005e7560
push 0x6e90f4
lea ecx, [ebp - 0x60]
push ecx
call fcn.0060fb01
int3
Function at 0x5eae10
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x669220
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
xor esi, esi
mov edi, ecx
mov dword [ebp - 0x14], esi
call fcn.005eab10
mov ebx, dword [ebp + 0xc]
cmp dword [ebx + 0x14], 0x10
jb 0x5eae47
mov eax, dword [ebx]
jmp 0x5eae49
mov eax, ebx
lea ecx, [ebp - 0x10]
push ecx
push esi
lea edx, [ebp - 0x14]
push edx
push esi
push eax
mov eax, dword [edi + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5eaf7e
mov eax, dword [ebp - 0x14]
cmp eax, 1
je 0x5eae77
cmp eax, 2
jne 0x5eaf7e
mov eax, dword [ebp - 0x10]
cmp eax, esi
jbe 0x5eaf5b
inc eax
push eax
call fcn.005fb5ce
add esp, 4
cmp dword [ebx + 0x14], 0x10
mov esi, eax
jb 0x5eae98
mov eax, dword [ebx]
jmp 0x5eae9a
mov eax, ebx
mov edx, dword [edi + 0x20]
lea ecx, [ebp - 0x10]
push ecx
push esi
push 0
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x10]
push 1
lea ecx, [ebp + 0xf]
push ecx
push esi
mov byte [esi + eax], 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ebx, eax
push ebx
call fcn.005fb5ce
add esp, 4
push ebx
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor ebx, ebx
mov eax, edi
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x5eaef0
sub eax, ecx
push eax
push edi
lea ecx, [ebp - 0x30]
call fcn.0041e350
push esi
mov dword [ebp - 4], 1
call fcn.00611a0b
push edi
call fcn.00611a0b
mov esi, dword [ebp + 8]
add esp, 8
lea edx, [ebp - 0x30]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push edx
mov ecx, esi
mov byte [esi], 0
call fcn.004647c0
cmp dword [ebp - 0x1c], 0x10
jb 0x5eaf46
mov eax, dword [ebp - 0x30]
push eax
call fcn.0060faf6
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 0x10], esi
pop edi
mov dword [eax + 0x14], 0xf
pop esi
mov byte [eax], 0
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
push ebx
lea ecx, [ebp - 0x30]
push ecx
mov ecx, edi
call fcn.005eaa10
push esi
push eax
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], esi
call fcn.005e7560
push 0x6e90f4
lea edx, [ebp - 0x60]
push edx
call fcn.0060fb01
int3
Function at 0x5eafb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x669288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push esi
push edi
mov esi, ecx
call fcn.005eab10
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x10], 4
jb 0x5eafe8
mov eax, dword [edi]
jmp 0x5eafea
mov eax, edi
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x18]
push edx
mov edx, dword [esi + 0x20]
lea ecx, [ebp - 0x14]
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5eb022
cmp dword [ebp - 0x14], 4
jne 0x5eb022
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push edi
lea eax, [ebp - 0x34]
push eax
mov ecx, esi
call fcn.005eaa10
push 0
push eax
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0
call fcn.005e7560
push 0x6e90f4
lea ecx, [ebp - 0x64]
push ecx
call fcn.0060fb01
int3

Function at 0x5eb050
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x669251
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbc
push esi
push edi
mov esi, ecx
call fcn.005eab10
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x10], 0
jb 0x5eb08b
mov eax, dword [edi]
jmp 0x5eb08d
mov eax, edi
lea ecx, [ebp - 0x14]
push ecx
push 0
lea edx, [ebp - 0x10]
push edx
push 0
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x5eb0d7
push edi
lea ecx, [ebp - 0xac]
push ecx
mov ecx, esi
call fcn.005eaa10
push 0
push eax
lea ecx, [ebp - 0x74]
mov dword [ebp - 4], 0
call fcn.005e7560
push 0x6e90f4
lea edx, [ebp - 0x74]
push edx
call fcn.0060fb01
mov eax, dword [ebp - 0x10]
cmp eax, 1
je 0x5eb131
cmp eax, 2
je 0x5eb131
cmp eax, 4
je 0x5eb131
push edi
lea eax, [ebp - 0x90]
push eax
mov ecx, esi
call fcn.005eaa10
push str.:_type_not_supported
push eax
lea ecx, [ebp - 0xc8]
push ecx
mov dword [ebp - 4], 1
call fcn.005e3fb0
add esp, 0xc
push 0
push eax
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.005e7560
push 0x6e90f4
lea edx, [ebp - 0x44]
push edx
call fcn.0060fb01
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5eb150
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x669268
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x1c], esi
call fcn.005eab10
mov edx, dword [esi + 0x20]
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
lea ecx, [ebp - 0x10]
push ecx
push ebx
push ebx
push ebx
push edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x5eb249
xor esi, esi
mov dword [ebp - 0x14], 0x100
cmp dword [ebp - 0x10], ebx
jbe 0x5eb249
push edi
mov edi, dword [ebp + 8]
jmp 0x5eb1c0
mov edx, dword [ebp - 0x1c]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
mov eax, dword [edx + 0x20]
lea ecx, [ebp - 0x138]
push ecx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x5eb237
lea eax, [ebp - 0x138]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x5eb1f7
sub eax, edx
push eax
lea ecx, [ebp - 0x138]
push ecx
lea ecx, [ebp - 0x38]
call fcn.0041e350
lea edx, [ebp - 0x38]
push edx
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.005ea1a0
cmp dword [ebp - 0x24], 0x10
mov dword [ebp - 4], 0xffffffff
jb 0x5eb237
mov eax, dword [ebp - 0x38]
push eax
call fcn.0060faf6
add esp, 4
inc esi
mov dword [ebp - 0x14], 0x100
cmp esi, dword [ebp - 0x10]
jb 0x5eb1c0
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x5eb260
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x669288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x128
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x18], esi
call fcn.005eab10
mov ecx, dword [esi + 0x20]
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x5eb352
xor esi, esi
mov dword [ebp - 0x14], 0x100
cmp dword [ebp - 0x10], ebx
jbe 0x5eb352
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x14]
push edx
mov edx, dword [ecx + 0x20]
lea eax, [ebp - 0x134]
push eax
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x5eb340
lea eax, [ebp - 0x134]
mov dword [ebp - 0x20], 0xf
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0x34], bl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x5eb300
sub eax, edx
push eax
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x34]
call fcn.0041e350
lea ecx, [ebp - 0x34]
push ecx
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.005ea1a0
cmp dword [ebp - 0x20], 0x10
mov dword [ebp - 4], 0xffffffff
jb 0x5eb340
mov edx, dword [ebp - 0x34]
push edx
call fcn.0060faf6
add esp, 4
inc esi
mov dword [ebp - 0x14], 0x100
cmp esi, dword [ebp - 0x10]
jb 0x5eb2c5
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x5eb3c7
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x700d74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5eb49c
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5eb48b
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x5eb475
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x5eb48b
push eax
push edi
push dword [ebp - 0x110]
call fcn.005eb364
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x5eb49e
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0061bab9
leave
ret 4
Function at 0x5fa370
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
pop ebp
ret

Function at 0x5faa50
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x700d74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
push edi
mov ebx, edx
xor eax, eax
lea esp, [esp]
mov byte [ecx + eax + 2], al
inc eax
cmp eax, 0x100
jb 0x5faa70
xor edi, edi
mov edi, edi
mov eax, edi
xor edx, edx
div dword [ebp + 8]
inc edi
mov al, byte [edx + ebx]
mov byte [ebp + edi - 0x105], al
cmp edi, 0x100
jb 0x5faa80
xor eax, eax
lea esp, [esp]
mov dl, byte [ecx + eax + 2]
movzx edi, byte [ebp + eax - 0x104]
movzx ebx, dl
add esi, edi
add esi, ebx
and esi, 0xff
mov bl, byte [ecx + esi + 2]
mov byte [ecx + eax + 2], bl
inc eax
mov byte [ecx + esi + 2], dl
cmp eax, 0x100
jb 0x5faaa0
mov word [ecx], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0061bab9
mov esp, ebp
pop ebp
ret

Function at 0x5faaf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, edx
test ecx, ecx
je 0x5fab99
push ebx
mov ebx, dword [ebp + 8]
push esi
sub ebx, edi
mov dword [ebp - 4], ecx
lea esp, [esp]
movzx ecx, byte [eax]
inc ecx
and ecx, 0x800000ff
jns 0x5fab24
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [eax], cl
movzx ecx, cl
movzx edx, byte [ecx + eax + 2]
lea esi, [ecx + eax + 2]
movzx ecx, byte [eax + 1]
add ecx, edx
and ecx, 0x800000ff
jns 0x5fab48
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [eax + 1], cl
mov dl, byte [esi]
movzx ecx, cl
movzx ecx, byte [ecx + eax + 2]
mov byte [esi], cl
movzx ecx, byte [eax + 1]
mov byte [ecx + eax + 2], dl
movzx edx, byte [eax + 1]
movzx ecx, byte [edx + eax + 2]
movzx edx, byte [eax]
movzx edx, byte [edx + eax + 2]
add ecx, edx
and ecx, 0x800000ff
jns 0x5fab82
dec ecx
or ecx, 0xffffff00
inc ecx
movzx ecx, byte [ecx + eax + 2]
xor cl, byte [ebx + edi]
inc edi
dec dword [ebp - 4]
mov byte [edi - 1], cl
jne 0x5fab10
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x5fad70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c0
mov eax, dword [0x700d74]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xbc]
push edi
push eax
call fcn.005fa370
push 0x20
lea ecx, [esi + 8]
push ecx
lea edx, [ebp - 0xbc]
push edx
call fcn.005fabf0
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.005facc0
add esp, 0x18
cmp dword [esi], 3
jne 0x5fadf3
mov edi, 0x32
lea edx, [ebp - 0xbc]
push edx
call fcn.005fa370
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x14]
push ecx
push edx
call fcn.005fabf0
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.005facc0
add esp, 0x18
dec edi
jne 0x5fadc3
mov edx, dword [esi + 4]
push edx
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x1c0]
call fcn.005faa50
lea eax, [esi + 0x28]
push eax
mov ecx, 0x20
lea edx, [ebp - 0x34]
lea eax, [ebp - 0x1c0]
call fcn.005faaf0
add esp, 8
cmp dword [esi], 3
jne 0x5fae91
push ebx
mov ebx, 1
lea ebx, [ebx]
mov edi, dword [esi + 4]
xor eax, eax
test edi, edi
je 0x5fae4f
lea esp, [esp]
mov cl, byte [ebp + eax - 0x14]
xor cl, bl
mov byte [ebp + eax - 0x44], cl
inc eax
cmp eax, edi
jb 0x5fae40
push 0x20
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x64]
push eax
call fcn.005f10c0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x1c0]
call fcn.005faa50
lea edx, [ebp - 0x64]
push edx
mov ecx, 0x20
lea edx, [ebp - 0x34]
lea eax, [ebp - 0x1c0]
call fcn.005faaf0
inc ebx
add esp, 0x14
cmp ebx, 0x13
jbe 0x5fae30
pop ebx
push 0x20
lea eax, [ebp - 0x34]
push eax
add esi, 0x48
push esi
call fcn.005f10c0
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
xor ecx, ebp
pop esi
call fcn.0061bab9
mov esp, ebp
pop ebp
ret
Function at 0x5fafa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x700d74]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
push edi
push eax
lea edx, [esi + 0x9c]
lea ecx, [ebp - 0x190]
call fcn.005faa50
lea edx, [esi + 0x68]
push 0x6990d0
mov ecx, 0x20
lea eax, [ebp - 0x190]
mov dword [ebp - 0x194], edx
call fcn.005faaf0
add esp, 8
cmp dword [esi], 3
jne 0x5fb0f3
lea ecx, [ebp - 0x8c]
push ebx
push ecx
call fcn.005fa370
push 0x20
lea edx, [ebp - 0x8c]
push 0x6990d0
push edx
call fcn.005fabf0
push 0x10
lea eax, [esi + 0x8c]
push eax
lea ecx, [ebp - 0x8c]
push ecx
call fcn.005fabf0
lea edx, [ebp - 0x8c]
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.005facc0
mov ecx, dword [esi + 4]
push ecx
lea edx, [esi + 0x9c]
lea ecx, [ebp - 0x190]
call fcn.005faa50
lea edx, [ebp - 0x24]
push edx
mov ecx, 0x10
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x190]
call fcn.005faaf0
add esp, 0x2c
mov ebx, 1
mov edi, dword [esi + 4]
xor eax, eax
test edi, edi
je 0x5fb092
lea esp, [esp]
mov cl, byte [esi + eax + 0x9c]
xor cl, bl
mov byte [ebp + eax - 0x34], cl
inc eax
cmp eax, edi
jb 0x5fb080
push 0x10
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.005f10c0
mov ecx, dword [esi + 4]
push ecx
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x190]
call fcn.005faa50
lea edx, [ebp - 0x24]
push edx
mov ecx, 0x10
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x190]
call fcn.005faaf0
inc ebx
add esp, 0x14
cmp ebx, 0x13
jbe 0x5fb070
mov esi, dword [ebp - 0x194]
push 0x20
push 0
push esi
call fcn.005f11a0
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.005f10c0
add esp, 0x18
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0061bab9
mov esp, ebp
pop ebp
ret

Function at 0x60ed18
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x71672c], 0
push esi
push edi
jne 0x60ec8e
call fcn.0060ebfa
test eax, eax
je 0x60ecd3
mov eax, dword [0x71672c]
cmp eax, 1
jne 0x60ecaf
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x60ecd3
jmp 0x60ed15
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x60ed15
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x60ecd7
xor eax, eax
jmp 0x60ed15
mov eax, dword [esi]
push dword [0x71672c]
call edi
mov edi, eax
test edi, edi
je 0x60ecf9
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x60ed15
lea edi, [esi + 0xff0]
push esi
push dword [0x71672c]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x60ecff
mov eax, esi
pop edi
pop esi
ret
jmp 0x60ec7a

Function at 0x61bab9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x700d74]
jne 0x61bac3
repz ret
jmp fcn.006333e8
Function at 0x62ab23
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x700d74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0062096b
and dword [ebp - 0x14], 0
cmp dword [0x717038], 0
mov dword [ebp - 0x18], eax
jne 0x62abd6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x62ac7e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x69b810
push ebx
call edi
test eax, eax
je 0x62ac7e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x69b800
push ebx
mov dword [0x717038], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x71703c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x717040], eax
call edi
push eax
call esi
mov dword [0x717048], eax
test eax, eax
je 0x62abd6
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x717044], eax
mov eax, dword [0x717044]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x62ac2f
cmp dword [0x717048], ecx
je 0x62ac2f
push eax
call esi
push dword [0x717048]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x62ac2f
test ebx, ebx
je 0x62ac2f
call edi
test eax, eax
je 0x62ac26
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x62ac26
test byte [ebp - 8], 1
jne 0x62ac2f
or dword [ebp + 0x10], 0x200000
jmp 0x62ac62
mov eax, dword [0x71703c]
cmp eax, dword [ebp - 0x18]
je 0x62ac62
push eax
call esi
test eax, eax
je 0x62ac62
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x62ac62
mov eax, dword [0x717040]
cmp eax, dword [ebp - 0x18]
je 0x62ac62
push eax
call esi
test eax, eax
je 0x62ac62
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x717038]
call esi
test eax, eax
je 0x62ac7e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x62ac80
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0061bab9
leave
ret
Function at 0x1001a6e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1001a6f3
pop dword [ebp - 0x2c]
mov eax, 0x12e92549
add eax, 0xfd1881aa
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x446ab
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x341ed926
sub ecx, 0x341e8146
xor esi, esi
add esi, eax
mov edx, 0x48ca6b40
add edx, 0xc73952c0
add edx, dword [ebp - 0x2c]
mov edi, 0x531096a2
mov dword [ebp - 8], 0xaab60b5e
mov ebx, dword [edx]
add dword [ebp - 0xc], 0xe215c7dd
add ebx, edi
add dword [ebp - 0x1c], 0xde984c98
mov dword [esi], ebx
xor dword [ebp - 4], 0x22248ba3
add esi, 0xedaef82d
add esi, 0x125107d7
add edx, 0x72acc5c8
sub edx, 0x72acc5c4
loop 0x1001a749
add eax, 0x15253
mov ebx, eax
add eax, 0x8dc0739
sub eax, 0x8dc0734
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001a6e4
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001a6e4
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret